CVE-2026-20951 Details
Description
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
A remote code execution vulnerability has been identified in Microsoft Office SharePoint. This issue arises from improper input validation, which allows an unauthorized attacker to execute code locally. The vulnerability affects multiple SharePoint server versions, including the Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.
Users can download the security update for Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, or SharePoint Enterprise Server 2016 from the Microsoft Update Catalog. Instructions for applying the update are available in the respective Knowledge Base articles.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20951 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| microsoft sharepoint server | < 16.0.19127.20442 2016 2019 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 14, 2026 | Initial Analysis | [email protected] |
| Jan 13, 2026 | New CVE Received | [email protected] |