cve 2026 20950

Microsoft’s choice to label CVE-2026-20950 an Excel “Remote Code Execution” vulnerability while publishing a CVSS vector with Attack Vector = Local (AV:L) is deliberate, not a classification error: the CVE title signals the attacker’s origin and the potential operational impact, whereas the CVSS...

Title: Why CVE-2026-20950 is labeled “Remote Code Execution” even though CVSS lists AV:L (Local) — a practical guide for Windows admins Introduction Short answer: “Remote” in the CVE title describes the attacker’s location (they can be off‑host and deliver a malicious file remotely); the CVSS...