Priority MEDIUM 58
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.18442 · Published 2026-01-13 · Fixed in 16.0.5535.1001, 16.0.10417.20083 +1 CWE-89
Priority LOW 37
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00597 · Published 2026-01-13 · Fixed in https://aka.ms/OfficeSecurityReleases, 16.105.26011018 +3 CWE-822
