CVE-2026-97781: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CWE-77) in Microsoft Office OneNote within Microsoft 365 Apps for Enterprise involves improper neutralization of special elements used in a command, enabling command injection. An attacker can remotely execute arbitrary code without privileges and with low attack complexity, requiring user interaction. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. No known active exploitation has been reported.

Successful exploitation allows an attacker to execute arbitrary code remotely, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability requires no privileges and low attack complexity but does require user interaction.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should follow the guidance in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97781 to ensure their environment is updated and protected.