VYPR
← All advisories
High severity8.8NVD Advisory· Published Jan 13, 2026· Updated Jun 17, 2026

CVE-2026-20947

CVE-2026-20947

Description

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Affected products

7
  • Microsoft/Sharepoint Servercpe-rescue5 versions
    16.0.0+ 4 more
    • (no CPE)range: 16.0.0
    • (no CPE)range: 16.0.0
    • cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*range: <16.0.19127.20442
    • cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*
  • Microsoft/Office SharePointcpe-rescue2 versions
    16.0.0+ 1 more
    • (no CPE)range: 16.0.0
    • (no CPE)

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.