This vulnerability (CVE-2026-55022) in Microsoft 365 Apps for Enterprise is classified as CWE-843 (Access of Resource Using Incompatible Type, or type confusion). It allows an unauthorized attacker to execute code locally by exploiting improper handling of resource types. The CVSS v3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, and user interaction required. The vulnerability impacts confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code locally on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the system running Microsoft 365 Apps for Enterprise version 16.0.1.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55022 to ensure their environments are updated and protected.