Microsoft’s advisory for CVE-2026-20953 is labeled a Remote Code Execution (RCE) vulnerability while the published CVSS base vector reports the Attack Vector as AV:L (Local) — a phrasing mismatch that has caused confusion among administrators, security teams, and risk managers. The apparent...