This vulnerability (CVE-2026-40421) in Microsoft 365 Apps for Enterprise (version 16.0.1) relates to CWE-73: External Control of File Name or Path. It allows an attacker to cause disclosure of local information by exploiting files or directories accessible externally in Microsoft Office Word. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality impact. Microsoft has published an official fix and manages remediation for this cloud service.

An unauthorized attacker can disclose local information by controlling file names or paths accessible through Microsoft Office Word in Microsoft 365 Apps for Enterprise. The confidentiality impact is limited, with no impact on integrity or availability. Exploitation requires user interaction but no privileges. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40421 for the latest update status and ensure their Microsoft 365 Apps for Enterprise environment is updated accordingly.