CVE-2026-81394: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-81394) involves exposure of sensitive system information to an unauthorized control sphere within Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. The flaw allows an attacker with local access and user interaction to disclose sensitive information. The CVSS 3.1 base score is 5.5, reflecting medium severity, with attack vector local, low attack complexity, no privileges required, and user interaction needed. The vulnerability does not impact integrity or availability but has a high impact on confidentiality. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild.

An attacker with local access and the ability to interact with the user interface can disclose sensitive system information. This could lead to information leakage that may aid further attacks or compromise privacy. There is no impact on system integrity or availability. The vulnerability affects confidentiality only.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Microsoft 365 Apps for Enterprise as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81394. Since this is a cloud service, Microsoft manages remediation server-side. No additional mitigation steps are required beyond applying the official fix.