CVE-2026-55022 is a type confusion vulnerability (CWE-843) in Microsoft 365 Apps for Enterprise that permits an unauthorized attacker to execute code locally by accessing resources using incompatible types. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with high impact on confidentiality, integrity, and availability. The vulnerability affects version 16.0.1 of the product. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are currently reported in the wild.

Successful exploitation of this vulnerability allows an unauthorized attacker to execute code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the affected environment. The CVSS score of 7.8 reflects significant impact with low attack complexity and no privileges required but user interaction needed.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure that their Microsoft 365 Apps for Enterprise installations are updated to the fixed version as per the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55022. No additional mitigation steps are required beyond applying the official update.