8.4 HighCWE-416
CVE-2026-40361
Microsoft 365 Apps for Enterprise vulnerability
MicrosoftMicrosoft 365 Apps for Enterprise
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 22 Oct
0.4%probability of exploitation in the next 30 days
Higher than 29% of scored CVEs
SeverityCVSS
8.4High
Description NVD
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Coverage 3 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 12 May · 21:31 UTC | Dark Reading | Microsoft Patch May 2026 fixes 137 bugs, zero day free |
| Wed 13 May · 11:01 UTC | SecurityWeek | Attackers can exploit CVE-2026-40361 via zero click Outlook flaw |
| Wed 13 May · 11:32 UTC | Malwarebytes | Patch Tuesday Updates Fix 137 Flaws, Including Critical Word Bug |
- Patch Tuesday Updates Fix 137 Flaws, Including Critical Word BugMalwarebytes
- Attackers can exploit CVE-2026-40361 via zero click Outlook flawSecurityWeek
- Microsoft Patch May 2026 fixes 137 bugs, zero day freeDark Reading · first in our coverage · mentions it in passing