Microsoft’s CVE listing for CVE-2026-20948 names the issue as a Remote Code Execution (RCE) vulnerability in Microsoft Word, but its published CVSS vector lists the Attack Vector as AV:L (Local) — a mismatch that confuses many administrators and risk managers. The two labels are not...
Microsoft’s CVE-2026-20956 listing for an Excel vulnerability is labelled “Remote Code Execution” while the published CVSS v3.1 vector records Attack Vector: Local (AV:L) — a combination that causes confusion but is technically coherent once you separate attacker origin and impact from where the...