This vulnerability (CVE-2026-35436) involves a use-after-free condition in Microsoft 365 Apps for Enterprise, which can be exploited by an authorized local attacker to elevate privileges. The root cause is insufficient granularity in access control, classified under CWE-1220. The CVSS v3.1 base score is 8.8, indicating high severity, with impact on confidentiality, integrity, and availability. Microsoft has issued an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

An authorized local attacker can exploit this vulnerability to elevate privileges, potentially gaining higher access rights than intended. This could lead to full compromise of the affected application environment, impacting confidentiality, integrity, and availability of data and services within Microsoft 365 Apps for Enterprise.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35436 to ensure their environments are updated and protected.