This vulnerability, tracked as CVE-2026-45459 and classified under CWE-693 (Protection Mechanism Failure), affects Microsoft Office Excel in Microsoft 365 Apps for Enterprise version 16.0.1. It enables an unauthorized local attacker to bypass a security feature, potentially weakening the intended protection mechanisms. The CVSS v3.1 base score is 3.3, indicating low severity, with attack vector local, low complexity, no privileges required, and user interaction needed. Microsoft has issued an official fix and manages remediation for this cloud-hosted service. No known exploitation in the wild has been reported.

The impact is limited to a local unauthorized attacker bypassing a security feature in Microsoft Excel, potentially reducing the effectiveness of security controls. Confidentiality is minimally affected, with no impact on integrity or availability reported. The low CVSS score reflects the limited scope and impact of this vulnerability.

An official fix is available from Microsoft. Since this affects a cloud service, Microsoft manages the remediation server-side. Users should ensure their Microsoft 365 Apps for Enterprise are updated to the fixed version as per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45459. No additional mitigation actions are required beyond applying the official fix.