CVE-2026-64918: CWE-522: Insufficiently Protected Credentials in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability, identified as CWE-522, concerns insufficient protection of credentials within Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to conduct spoofing attacks over a network by exploiting the weak credential protection. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality impact without integrity or availability impact. Microsoft has issued an official fix and manages remediation for this cloud service. The affected versions include 16.0.0, 16.0.1, 19.0.0, and versions from 16.0.0 up to but not including 16.0.5569.1003.

An attacker could perform spoofing attacks over a network due to insufficient credential protection, potentially leading to unauthorized access to sensitive information. The confidentiality impact is high, but integrity and availability are not affected. No active exploitation in the wild has been reported.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation process. Users and administrators should apply the official updates as directed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64918 to mitigate this vulnerability.