This vulnerability stems from improper neutralization of user input when generating web pages within Microsoft Excel, resulting in a cross‑site scripting (CWE‑79) flaw that can expose sensitive data to an unauthorized network attacker. The weakness allows malicious code to be injected into Excel’s web‑display context, potentially leaking confidential information. The impact is therefore focused on confidentiality breach rather than code execution or service disruption.

Affected products include Microsoft 365 Apps for Enterprise. No specific affected version numbers are listed in the provided data. The vulnerability is therefore presumed to apply to any current or legacy releases of the suite until a mitigating update is installed.

The CVSS score of 7.5 indicates a high severity impact. EPSS indicates the probability of exploitation is below 1%, suggesting a low likelihood of widespread attacks at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, where an attacker supplies a crafted Excel file or embedded web content that triggers the XSS when the workbook is opened over a network. No additional exploitation conditions are mentioned in the data.