CVE-2026-81385: CWE-502: Deserialization of Untrusted Data in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-81385) is a deserialization of untrusted data flaw in Microsoft Office Publisher within Microsoft 365 Apps for Enterprise. It allows remote code execution by processing maliciously crafted data. The CVSS v3.1 score is 8.8, indicating high impact with network attack vector, low attack complexity, no privileges required, and user interaction needed. The vulnerability affects several version ranges of Microsoft 365 Apps for Enterprise prior to fixed builds. Microsoft has published an official fix and manages remediation for this cloud-hosted service.

Successful exploitation can lead to remote code execution with high confidentiality, integrity, and availability impact. An attacker can execute arbitrary code over the network without privileges but requires user interaction. This can compromise affected systems and data.

An official fix is available from Microsoft. Users and administrators should apply the updates as per the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81385. Since this is a cloud service, Microsoft manages remediation server-side for cloud-hosted components. No additional mitigation actions are indicated by the vendor advisory.