This vulnerability, tracked as CVE-2026-45459 and classified under CWE-693 (Protection Mechanism Failure), affects Microsoft Office Excel in Microsoft 365 Apps for Enterprise version 16.0.1. It permits an unauthorized attacker with local access to bypass a security feature, potentially weakening the protection mechanism. The CVSS v3.1 base score is 3.3, reflecting low severity with local attack vector, low complexity, no privileges required, and user interaction needed. Microsoft has issued an official fix and manages remediation for this cloud service. No known exploits are reported in the wild.

The impact is limited to a local attacker bypassing a security feature in Microsoft Excel, resulting in limited confidentiality impact and no integrity or availability impact. The low CVSS score reflects the limited scope and complexity of exploitation. There are no known active exploits.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated per Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45459 to apply the fix.