This vulnerability (CVE-2026-40421) in Microsoft 365 Apps for Enterprise arises from external control of file name or path in Microsoft Office Word. It allows an attacker to potentially disclose information over a network without requiring privileges but does require user interaction. The CVSS 3.1 base score is 4.3 (medium severity), with attack vector network, low complexity, no privileges required, user interaction required, and impact limited to confidentiality. Microsoft has issued an official fix and manages remediation for this cloud-hosted service.

An attacker could leverage this vulnerability to disclose information over a network, potentially exposing sensitive data. The impact is limited to confidentiality with no integrity or availability effects. Exploitation requires user interaction, and there are no known exploits in the wild currently.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40421 to protect against this vulnerability.