What is the CVSS score of CVE-2026-20943?

CVE-2026-20943 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Office Deployment Tool are affected by CVE-2026-20943?

Organizations using Untrusted search path in Microsoft Office face moderate risk from CVE-2026-20943 rated CVSS 7.0. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-20943?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Office Deployment Tool CVE-2026-20943

HIGH

Untrusted Search Path (CWE-426)

2026-01-13 secure@microsoft.com

Microsoft Office Deployment Tool Sharepoint Server Office

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 13, 2026 - 18:16 nvd

HIGH 7.0

DescriptionCVE.org

Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally. [CVSS 7.0 HIGH]

Technical ContextAI

Classified as CWE-426 (Untrusted Search Path). Affects Office. Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally.