CVE-2026-20947
Published: 13 January 2026
Summary
CVE-2026-20947 is a high-severity SQL Injection (CWE-89) vulnerability in Microsoft Sharepoint Server. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates SQL injection by requiring validation and proper neutralization of special elements in user inputs to SQL commands in SharePoint.
Ensures timely identification, reporting, and patching of the specific SQL injection flaw in SharePoint as detailed in the Microsoft advisory.
Mitigates the arbitrary code execution consequence of successful SQL injection through memory protection techniques like ASLR and control flow integrity.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in SharePoint web app directly enables remote exploitation for arbitrary code execution over the network.
NVD Description
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Deeper analysisAI
CVE-2026-20947 is an SQL injection vulnerability (CWE-89) affecting Microsoft Office SharePoint, stemming from improper neutralization of special elements used in an SQL command. Published on 2026-01-13T18:16:22.167, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation with significant impacts.
An authorized attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction required (UI:N). Successful exploitation enables arbitrary code execution, resulting in high confidentiality, integrity, and availability impacts (C:H/I:H/A:H) without changing scope (S:U).
Mitigation details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20947.
Details
- CWE(s)