Summary
Ein Angreifer kann mehrere Schwachstellen in verschiedenen Microsoft Office Produkten und Sharepoint ausnutzen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen, um falsche Informationen darzustellen, und um Sicherheitsvorkehrungen zu umgehen.
Product
Die Microsoft Office Suite beinhaltet zahlreiche Büroanwendungen wie Textverarbeitung, Tabellenkalkulation, Datenbank und weitere Applikationen.
Microsoft Office Online Server ist ein Serverprodukt, das browserbasierte Versionen von Word, PowerPoint, Excel und OneNote bereitstellt.
Microsoft Sharepoint ist ein Portalsystem für die zentrale Verwaltung von Dokumenten und Anwendungen. Die Inhalte werden u. a. über Webseiten zur Verfügung gestellt.
Microsoft 365 Apps ist eine Office Suite für zahlreiche Büroanwendungen.
Vulnerabilities 16
-
Critical 9.8
Microsoft SharePoint Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
KEV Mar 18, 2026 -
High 8.8CVE-2026-20947 EPSS 18%
Microsoft SharePoint Server Remote Code Execution Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
-
High 8.4
Microsoft Word Remote Code Execution Vulnerability
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally.
-
High 8.4
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
-
High 8.4
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Word Remote Code Execution Vulnerability
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Security Feature Bypass Vulnerability
Improper access control in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft SharePoint Server Remote Code Execution Vulnerability
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.0
Microsoft Office Click-To-Run Remote Code Execution Vulnerability
Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally.
-
Medium 5.4
Microsoft SharePoint Information Disclosure Vulnerability
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
-
Medium 4.6
Microsoft SharePoint Server Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Revision history
-
#3
CVE-2026-20963 von Microsoft neu bewertet
-
#2
CVE-2026-20963 wird ausgenutzt
-
#1
Initiale Fassung
References
-
Microsoft Leitfaden für Sicherheitsupdates
https://msrc.microsoft.com/update-guide/
-
CISA Known Exploited Vulnerabilities Catalog vom 2026-03-18
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20963
-
Microsoft Security Update Guide CVE-2026-20963 vom 2026-03-22
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963