CVE-2026-20943

CWE-4265 documents5 sources
Severity
7.0HIGH
EPSS
0.0%
top 85.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Microsoft Microsoft Office 2016Microsoft Microsoft Office Deployment ToolMicrosoft Microsoft Sharepoint Enterprise Server 2016+5 more
Timeline
PublishedJan 13

Description

Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9

Affected Packages8 packages

▶CVEListV5microsoft/microsoft_office_201616.0.0 — 16.0.5535.1000
▶NVDmicrosoft/office_deployment_tool< 16.0.19426.20170
▶CVEListV5microsoft/microsoft_office_deployment_tool1.0 — 16.0.19426.20170
▶NVDmicrosoft/sharepoint_server< 16.0.19127.20442+2

🔴Vulnerability Details

2
GHSA
GHSA-7mcc-vv62-fp9q: Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally↗2026-01-13
▶
CVEList
Microsoft Office Click-To-Run Remote Code Execution Vulnerability↗2026-01-13
▶

📋Vendor Advisories

1
Microsoft
Microsoft Office Click-To-Run Remote Code Execution Vulnerability↗2026-01-13
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-20943 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶