CVE-2026-20947: Microsoft SharePoint Server Remote Code Execution Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Other sources
Microsoft SharePoint Server Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.10417.20083Patch KB5002823 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.19127.20442Patch KB5002822 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.5535.1001Fixed in 16.0.5535.1000Patch KB5002827
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20947?
CVE-2026-20947 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-20947?
To address CVE-2026-20947, apply the latest security patches provided by Microsoft for affected SharePoint products.
Who is affected by CVE-2026-20947?
CVE-2026-20947 affects Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016.
What types of attacks can CVE-2026-20947 enable?
CVE-2026-20947 allows an authorized attacker to execute arbitrary code remotely over a network.
When was CVE-2026-20947 disclosed?
CVE-2026-20947 was disclosed in a Microsoft security update, details of which can be found in their update guides.