CVE-2026-81401: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-81401) involves a type confusion flaw (CWE-843) in Microsoft Office Excel as part of Microsoft 365 Apps for Enterprise. The flaw allows unauthorized local information disclosure by accessing resources using incompatible types. The CVSS 3.1 base score is 5.5, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, and user interaction needed. Microsoft has published an official fix and manages remediation for this cloud service. No active exploitation has been reported.

An attacker can locally disclose sensitive information due to improper handling of resource types in Excel. The impact is limited to information disclosure without integrity or availability effects. The attack requires local access and user interaction.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise installations are updated according to Microsoft's guidance. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81401 for detailed patching instructions.