This vulnerability (CVE-2026-44817) is a type confusion flaw (CWE-843) in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute code locally by accessing a resource using an incompatible type. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known active exploitation has been reported.

Successful exploitation allows an unauthorized attacker to execute code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the affected environment.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise installations are updated to the fixed version as per Microsoft's update guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44817.