CVE-2026-62804: CWE-73: External Control of File Name or Path in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability, tracked as CVE-2026-62804 and categorized under CWE-73 (External Control of File Name or Path), affects Microsoft Office Word within Microsoft 365 Apps for Enterprise. It allows an attacker to influence file names or paths externally, potentially leading to local code execution. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

Successful exploitation could allow an attacker to execute arbitrary code locally on the affected system, compromising confidentiality, integrity, and availability of the system. The vulnerability requires local access and user interaction, limiting remote exploitation but still posing a significant risk if exploited.

An official fix is available from Microsoft and should be applied promptly. The vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62804 provides detailed remediation guidance. Since this is a cloud-hosted service, Microsoft manages remediation for the cloud components. Users should ensure their Microsoft 365 Apps for Enterprise installations are updated to patched versions.