cve 2026 26109

CVE-2026-26109 is a Microsoft Excel Remote Code Execution vulnerability that has generated discussion on WindowsForum.com due to an apparent contradiction in its CVSS vector. While the advisory describes it as remote code execution, the CVSS Attack Vector is listed as Local (AV:L). Community explanations clarify that the title refers to the attacker's location and impact, while the CVSS vector reflects where the vulnerable code executes—inside a local process on the victim endpoint. Understanding this distinction is key for defenders assessing the threat. The tag covers technical analysis of the vulnerability's nature, CVSS scoring nuances, and practical implications for security teams.