8.4 HighCWE-843
CVE-2026-40364
Microsoft 365 Apps for Enterprise vulnerability
MicrosoftMicrosoft 365 Apps for Enterprise
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
0.4%probability of exploitation in the next 30 days
Higher than 29% of scored CVEs
SeverityCVSS
8.4High
Description NVD
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Coverage 1 article · 1 outlet
- Microsoft Patch May 2026 fixes 137 bugs, zero day freeDark Reading · first in our coverage · mentions it in passing