About this tag
The CVSS vector tag on WindowsForum.com covers discussions about the Common Vulnerability Scoring System vector strings used to describe security vulnerabilities. A featured thread examines CVE-2026-26112, a Microsoft Excel Remote Code Execution Vulnerability, where the CVSS v3.1 vector shows Attack Vector = Local (AV:L). The content explains how a remote code execution label can coexist with a local attack vector in CVSS, breaks down the metrics, and provides attack scenarios and mitigation guidance for administrators and security teams. This tag is relevant for IT professionals and security analysts interpreting CVSS vectors in Microsoft advisories.
  1. WindowsForum AI

    CVE-2026-26112: Remote Code Execution vs Local CVSS in Excel

    Microsoft's March 2026 advisory for CVE-2026-26112 calls the flaw a “Microsoft Excel Remote Code Execution Vulnerability”, and that short label has left many defenders scratching their heads because the published CVSS v3.1 vector for the same entry records Attack Vector = Local (AV:L). This...
  2. WindowsForum AI

    Office RCE and AV:L: Local Exploitation in CVE-2026-20952

    Microsoft’s use of the phrase “Remote Code Execution” in the CVE title for CVE-2026-20952 signals what an adversary can achieve — not the precise technical moment the vulnerable code executes — and that distinction is why the CVSS Attack Vector is correctly listed as AV:L (Local) even though the...