This vulnerability, identified as CVE-2026-35436 and classified under CWE-1220, is a use-after-free issue in Microsoft 365 Apps for Enterprise. It enables an authorized attacker with local access to elevate their privileges due to insufficient granularity in access control mechanisms. The CVSS 3.1 score is 8.8, indicating high severity with high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

The vulnerability allows an authorized local attacker to elevate privileges, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. Given the high CVSS score and the nature of the flaw, successful exploitation could result in significant security impact within environments using Microsoft 365 Apps for Enterprise.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35436 to ensure their environments are protected.