This vulnerability (CVE-2026-35440) involves improper access controls in Microsoft Office Word within Microsoft 365 Apps for Enterprise, allowing unauthorized external parties to access files or directories locally. The CVSS 3.1 vector indicates local attack vector with low complexity and no privileges required, but user interaction is needed. The impact is high confidentiality loss without integrity or availability impact. Microsoft has released an official fix and manages remediation for this cloud-hosted service. No known active exploitation has been reported.

An attacker can disclose sensitive information locally by accessing files or directories that should be restricted. This confidentiality breach does not affect data integrity or availability. The vulnerability requires user interaction but no privileges, making it a moderate risk. No known exploits are currently active.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise installations are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35440. No additional mitigation actions are indicated by the vendor.