cvss vector

Microsoft's March 2026 advisory for CVE-2026-26112 calls the flaw a “Microsoft Excel Remote Code Execution Vulnerability”, and that short label has left many defenders scratching their heads because the published CVSS v3.1 vector for the same entry records Attack Vector = Local (AV:L). This...

Microsoft’s use of the phrase “Remote Code Execution” in the CVE title for CVE-2026-20952 signals what an adversary can achieve — not the precise technical moment the vulnerable code executes — and that distinction is why the CVSS Attack Vector is correctly listed as AV:L (Local) even though the...