This vulnerability, identified as CWE-522, concerns insufficient protection of credentials within Microsoft Office Outlook in Microsoft 365 Apps for Enterprise. An attacker exploiting this flaw could perform spoofing attacks over a network. The CVSS 3.1 base score is 4.3, indicating medium severity, with network attack vector, low attack complexity, no privileges required, and user interaction required. Microsoft has issued an official fix and manages remediation for this cloud service. No known exploits are reported in the wild.

The impact is limited to potential credential spoofing over a network, which could lead to unauthorized impersonation. Confidentiality impact is low, with no integrity or availability impacts reported. No active exploitation has been observed.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62882 for update status and guidance.