cve 2026 20956

CVE-2026-20956 is a Microsoft Excel vulnerability classified as Remote Code Execution (RCE) despite its CVSS v3.1 Attack Vector being Local (AV:L). This apparent contradiction arises because the CVE title describes the attacker's origin and worst-case impact, while the CVSS metric records the technical locality of the exploit trigger. The vulnerability typically involves remote delivery of a malicious Excel document that executes locally when opened. For defenders, understanding this distinction is crucial for prioritizing mitigations such as blocking untrusted macros, enabling Protected View, and applying Microsoft's security updates. The tag covers discussions explaining the technical rationale behind the labeling and practical steps administrators should take.