Main Vulnerability Database Vulnerabilities #VU121455

Untrusted search path in Microsoft products - CVE-2026-20943

Published: January 14, 2026

Vulnerability identifier: #VU121455

CSH Severity: High

CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-20943

CWE-ID: CWE-426

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to usage of an untrusted search path in Microsoft Office Click-To-Run. A remote attacker can trick a victim to open a specially crafted file and execute arbitrary code with escalated privileges.

Affected software

Office Deployment Tool
Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Enterprise Server
Microsoft SharePoint Server
Microsoft Office

How to mitigate CVE-2026-20943

Install updates from vendor's website.

External References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20943

Related Security Bulletins