This vulnerability (CVE-2026-45459) in Microsoft 365 Apps for Enterprise's Excel component involves a failure in a protection mechanism that enables an unauthorized local attacker to bypass a security feature. The CVSS 3.1 base score is 3.3 (low), with attack vector local, low attack complexity, no privileges required, and user interaction required. The impact is limited to partial confidentiality loss with no integrity or availability impact. Microsoft has issued an official fix and manages remediation for this cloud-hosted service. The affected version is 16.0.1.

An unauthorized local attacker can bypass a security feature in Microsoft Excel, potentially leading to limited confidentiality impact. There is no impact on integrity or availability. The vulnerability requires local access and user interaction, limiting exploitation scope. No known exploits are reported in the wild.

An official fix is available from Microsoft. Since this is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise installations are updated to the fixed version as per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45459.