This vulnerability (CVE-2026-62870) involves a use-after-free condition in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. An attacker can exploit this flaw to execute arbitrary code remotely without privileges, requiring user interaction. The CVSS v3.1 score is 8.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has acknowledged the issue and provided an official fix. The vulnerability affects version 16.0.1 of Microsoft 365 Apps for Enterprise. The product is a cloud service, and Microsoft manages remediation for this environment.

Successful exploitation allows an attacker to execute arbitrary code remotely, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability with high severity. No known active exploits have been reported.

An official fix is available from Microsoft. Users and administrators should apply the provided security update to Microsoft 365 Apps for Enterprise version 16.0.1 promptly. Since this is a cloud service, Microsoft manages remediation server-side; verify that updates have been applied through the Microsoft update guide. No additional mitigation steps are indicated by the vendor advisory.