Microsoft’s advisory for CVE-2026-20955 labels the bug as a “Microsoft Excel Remote Code Execution Vulnerability,” yet the published CVSS Attack Vector for the issue is Local (AV:L) — a wording mismatch that has left many admins and vulnerability managers asking whether Microsoft misclassified...