CVE-2026-35436
Published: 12 May 2026
Summary
CVE-2026-35436 is a high-severity Insufficient Granularity of Access Control (CWE-1220) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, it is not currently listed in the CISA KEV catalog.
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use of granular security and privacy attributes enables finer access control than coarse permission models alone.
Documenting interface characteristics enables more granular control over internal access.
Requires the architecture to describe granularity and placement of controls, preventing insufficiently fine-grained access decisions.
Provides the necessary granularity by placing system management functions outside the reach of user-level access controls.
Isolation supplies an explicit, enforceable granularity boundary between security and non-security functions that coarser access-control schemes lack.
NVD Description
Insufficient granularity of access control in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
Deeper analysisAI
Automated synthesis unavailable for this CVE.
Details
- CWE(s)