This vulnerability (CVE-2026-65807) is a type confusion flaw (CWE-843) in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It allows an attacker to access resources using incompatible types, which can lead to remote code execution without requiring privileges but with user interaction. The CVSS 3.1 base score is 8.8, indicating high severity, with network attack vector, low attack complexity, no privileges required, and user interaction needed. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The affected version explicitly identified is 16.0.1.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the impacted environment. The attack requires user interaction but no prior privileges. There are no known exploits in the wild currently.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65807 to address this vulnerability.