Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
References
| Link | Resource |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20947 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
16 Jan 2026, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Microsoft
Microsoft sharepoint Server |
|
| CPE | cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:* cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:* |
|
| References | () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20947 - Vendor Advisory |
13 Jan 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-13 18:16
Updated : 2026-01-16 16:17
NVD link : CVE-2026-20947
Mitre link : CVE-2026-20947
CVE.ORG link : CVE-2026-20947
JSON object : View
Products Affected
microsoft
- sharepoint_server
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')