CVE-2026-20943HighCVSS 7.0
Microsoft Office Click-To-Run Remote Code Execution Vulnerability
🔗 CVE IDs covered (1)
📋 Description
Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally.
🎯 Affected products6
- Microsoft Office 2016 (32-bit edition)
- Microsoft Office 2016 (64-bit edition)
- Microsoft Office Deployment Tool
- Microsoft SharePoint Enterprise Server 2016
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server Subscription Edition
✅ Remediation
KB5002825 (Security Update) — fixed build 16.0.10417.20083 KB5002826 (Security Update) — fixed build 16.0.5535.1000 KB5002828 (Security Update) — fixed build 16.0.5535.1001 KB5002822 (Security Update) — fixed build 16.0.19127.20442 KBRelease Notes (Security Update) — fixed build 16.0.19426.20170
🔗 References (10)
- advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20943
- patchhttps://www.microsoft.com/en-us/download/details.aspx?id=108525
- referencehttps://support.microsoft.com/help/5002825
- patchhttps://www.microsoft.com/en-us/download/details.aspx?id=108523
- referencehttps://support.microsoft.com/help/5002826
- patchhttps://www.microsoft.com/en-us/download/details.aspx?id=108518
- referencehttps://support.microsoft.com/help/5002828
- patchhttps://www.microsoft.com/en-us/download/details.aspx?id=108517
- referencehttps://support.microsoft.com/help/5002822
- referencehttps://www.microsoft.com/en-in/download/details.aspx?id=49117&msockid=35f9adb0e74b61392038b90de6fe608c