CVE-2026-20943

CVE-2026-20943 is an untrusted search path vulnerability in Microsoft Office, Microsoft Office Deployment Tool, and Microsoft SharePoint Server that allows an unauthorized attacker to execute code locally. With a CVSS score of 7.0 (HIGH), successful exploitation requires high attack complexity and user interaction, but can lead to complete compromise of confidentiality, integrity, and availability. Despite its severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in CISA's KEV catalog. While community discussion and media coverage are notable, the vulnerability is currently considered inactive on hot lists.