High severity7.0NVD Advisory· Published Jan 13, 2026· Updated Jun 17, 2026

CVE-2026-20943

Description

Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally.

Microsoft/Office3 versions
cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x64:*+ 2 more
- cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x64:*
- cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x86:*
- (no CPE)
Microsoft/Office Deployment Tool2 versions
cpe:2.3:a:microsoft:office_deployment_tool:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:microsoft:office_deployment_tool:*:*:*:*:*:*:*:*range: <16.0.19426.20170
- (no CPE)range: 1.0
Microsoft/Sharepoint Server5 versions
cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*+ 4 more
- cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*range: <16.0.19127.20442
- cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*
- cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*
- (no CPE)range: 16.0.0
- (no CPE)range: 16.0.0
Microsoft/Office Visiocpe-rescue
Range: 16.0.0
Microsoft/Office SharePointcpe-rescue
Range: 16.0.0