This vulnerability (CVE-2026-35436) affects Microsoft 365 Apps for Enterprise version 16.0.1 and is classified under CWE-1220 for insufficient granularity of access control. It allows an attacker with some level of local authorization to escalate privileges due to improper access control enforcement in the Office Click-To-Run component. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, and a scope change with high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service.

An authorized local attacker can exploit this vulnerability to elevate privileges, potentially gaining higher-level access than intended. This can lead to full compromise of the affected system's confidentiality, integrity, and availability. Since the product is cloud-based, the impact could extend to cloud service environments if not remediated.

An official fix is available from Microsoft and should be applied promptly. Because this is a cloud-hosted service, Microsoft manages the remediation on their side. Users and administrators should follow guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35436 to ensure their environments are updated. There are no known exploits in the wild, reducing immediate urgency but patching is recommended to prevent potential exploitation.