CVE-2026-20947:

SQL injection vulnerability in Microsoft Office SharePoint allows remote code execution.

Score
A numerical rating that indicates how dangerous this vulnerability is.

8.8High

Published Date:Jan 13, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:0.1
EPSS Percentile:16%

Exploitability

Score:2.8
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:LOW
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

SQL injection vulnerability in Microsoft Office SharePoint allows remote code execution.

Overview

The vulnerability (CVE-2026-20947) in Microsoft Office SharePoint is classified as a SQL injection flaw, corresponding to CWE-89. It allows an attacker with low privileges to execute code remotely without user interaction. The attack vector is network-based, with low attack complexity. The CVSS v3.1 base score is 8.8, indicating high severity. This vulnerability could lead to significant impacts on confidentiality, integrity, and availability of the affected SharePoint systems. The exploit's potential for unauthorized data access, manipulation, and system compromise makes it a critical security concern for organizations using SharePoint.

Remediation

To address this vulnerability, organizations should:
1. Apply the latest security patches provided by Microsoft as soon as they become available.
2. Implement proper input validation and parameterized queries to prevent SQL injection attacks.
3. Regularly audit and review SharePoint configurations and permissions to ensure least privilege principles are followed.
4. Use web application firewalls (WAF) to help detect and block SQL injection attempts.
5. Conduct regular security assessments and penetration testing to identify potential vulnerabilities.
6. Educate developers on secure coding practices, particularly regarding SQL injection prevention.
7. Monitor SharePoint logs for any suspicious activities that could indicate exploitation attempts.