This vulnerability (CVE-2026-40420) affects Microsoft 365 Apps for Enterprise version 16.0.1 and involves improper access control (CWE-284) in the Office Click-To-Run mechanism. An authorized attacker with local access can exploit this flaw to elevate their privileges, potentially gaining higher-level permissions than intended. The CVSS 3.1 base score is 8.8 with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting local attack vector, low attack complexity, required privileges, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. The vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40420.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially leading to full compromise of the affected Microsoft 365 Apps for Enterprise environment. This can result in unauthorized access to sensitive data, modification of information, and disruption of service availability. The vulnerability affects confidentiality, integrity, and availability at a high level.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise environment is updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40420 to mitigate this vulnerability.