CVE-2026-88210: CWE-807: Reliance on Untrusted Inputs in a Security Decision in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-88210) in Microsoft Office Word within Microsoft 365 Apps for Enterprise is classified under CWE-807, indicating reliance on untrusted inputs in a security decision. This flaw allows an unauthorized local attacker to bypass security features. The CVSS 3.1 base score is 7.8 (high), reflecting high impact on confidentiality, integrity, and availability. The vulnerability affects versions =1.0.0, =16.0.0, =16.0.1, and all versions >=16.0.0 but <16.0.17932.21056. Microsoft has issued an official fix, and the vendor advisory is available at the Microsoft Security Response Center.

An unauthorized local attacker can bypass security features in Microsoft Office Word, potentially leading to full compromise of confidentiality, integrity, and availability of affected systems. The vulnerability is exploitable with low attack complexity and no privileges required, but user interaction is needed. There are no known exploits in the wild currently.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Microsoft 365 Apps for Enterprise as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88210. Since this is a cloud service, Microsoft manages remediation for cloud-hosted components. Ensure that all affected versions are updated to the fixed release to mitigate this vulnerability.