This vulnerability (CVE-2026-68806) involves an out-of-bounds write (CWE-787) in Microsoft Excel within Microsoft 365 Apps for Enterprise. The flaw enables an unauthorized attacker to execute code locally, potentially leading to full compromise of confidentiality, integrity, and availability. The CVSS 3.1 score is 7.8, reflecting high impact with local attack vector, low attack complexity, no privileges required, and user interaction needed. Microsoft has issued an official fix and manages remediation for this cloud service. The affected version explicitly identified is 16.0.1.

Successful exploitation allows an attacker to execute arbitrary code locally on the affected system, resulting in high impact to confidentiality, integrity, and availability of the system. This could lead to full system compromise if exploited.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68806 to mitigate this vulnerability.