CVE-2026-97771: CWE-416: Use After Free in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-97771) is a use-after-free flaw (CWE-416) in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables remote code execution by an unauthorized attacker over a network. The CVSS 3.1 base score is 8.8, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability. Multiple affected versions are identified, and Microsoft has released an official fix. The vendor advisory confirms the patch availability and that remediation is managed for the cloud service.

Successful exploitation allows an unauthorized attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the affected Microsoft 365 Apps for Enterprise environment. This could enable control over the affected system or data.

An official fix is available from Microsoft. Users and administrators should apply the provided updates as per the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97771. Since this is a cloud-hosted service, Microsoft manages remediation server-side for cloud instances. There are no known exploits in the wild, but timely patching is recommended.