Microsoft Office CVE-2026-35436

Requires an authenticated low-privileged local account on a Windows host running a Click-To-Run installation of Microsoft Office (Microsoft 365 Apps for Enterprise, Office 2019, or Office LTSC 2021/2024) with the OfficeClickToRun servicing component present - the standard deployment for these products. Per the CVSS vector, exploitation is local only (AV:L, so no remote/network path) and needs pre-existing valid credentials or an existing foothold (PR:L), but needs no user interaction (UI:N) and no elevated privileges to start. Limiting factors: the attacker must already be able to execute code locally as a normal user, and no evidence of automation or active exploitation exists (SSVC Automatable: no, Exploitation: none), which narrows realistic risk to environments where untrusted users have local access.

The signals are consistent and point to a genuine but not urgent-in-the-wild issue. CVSS 8.8 is high, driven by scope change and total C/I/A impact, but attack vector is local (AV:L) and requires an authenticated low-privileged user (PR:L), so this is not a remote or unauthenticated threat - an attacker must already have a foothold on the machine. EPSS is very low at 0.04% (12th percentile) and CISA SSVC lists Exploitation as 'none' and Automatable as 'no', while Technical Impact is 'total', which aligns with a powerful-but-hard-to-mass-exploit local escalation. It is not on CISA KEV and no POC is identified, so there is no evidence of active exploitation. The one minor tension worth flagging: the input Tags label this 'Information Disclosure' whereas the description and CWE describe local privilege elevation via access-control weakness - treat it as an elevation-of-privilege bug per the CVE description and CVSS, and verify the exact primitive against the MSRC advisory. Priority: standard-to-elevated patch cadence, higher on multi-user or shared workstations where local low-priv users are untrusted.

An attacker who already has a standard (low-privileged) account on a workstation - for example a logged-in employee, or an intruder who gained an unprivileged shell via phishing - invokes the vulnerable operation exposed by the Office Click-To-Run servicing component and abuses its coarse access control to have actions performed in the SYSTEM-level context. This yields full local privilege escalation (total C/I/A) and a scope change to the wider host. No public exploit code is identified at time of analysis, and no user interaction is required once the attacker has local access.