This vulnerability (CVE-2026-40420) affects Microsoft 365 Apps for Enterprise version 16.0.1 and involves a use-after-free condition that enables an authorized attacker with local access to elevate their privileges. The flaw is categorized under CWE-284, indicating improper access control. The CVSS v3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially gaining higher-level access within the affected Microsoft 365 Apps for Enterprise environment. The impact includes complete compromise of confidentiality, integrity, and availability of the affected system components.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise environment is updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40420. No additional mitigation actions are required beyond applying the official fix.