Cyber Posture

CVE-2026-20947

High

Published: 13 January 2026

Published
13 January 2026
Modified
16 January 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0013 31.4th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-20947 is a high-severity SQL Injection (CWE-89) vulnerability in Microsoft Sharepoint Server. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates SQL injection by requiring validation and proper neutralization of special elements in user inputs to SQL commands in SharePoint.

prevent

Ensures timely identification, reporting, and patching of the specific SQL injection flaw in SharePoint as detailed in the Microsoft advisory.

prevent

Mitigates the arbitrary code execution consequence of successful SQL injection through memory protection techniques like ASLR and control flow integrity.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

SQL injection in SharePoint web app directly enables remote exploitation for arbitrary code execution over the network.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Deeper analysisAI

CVE-2026-20947 is an SQL injection vulnerability (CWE-89) affecting Microsoft Office SharePoint, stemming from improper neutralization of special elements used in an SQL command. Published on 2026-01-13T18:16:22.167, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation with significant impacts.

An authorized attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction required (UI:N). Successful exploitation enables arbitrary code execution, resulting in high confidentiality, integrity, and availability impacts (C:H/I:H/A:H) without changing scope (S:U).

Mitigation details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20947.

Details

CWE(s)

Affected Products

microsoft
sharepoint server
2016, 2019 · ≤ 16.0.19127.20442

CVEs Like This One

CVE-2025-59237Same product: Microsoft Sharepoint Server
CVE-2025-21348Same product: Microsoft Sharepoint Server
CVE-2025-49704Same product: Microsoft Sharepoint Server
CVE-2026-26114Same product: Microsoft Sharepoint Server
CVE-2026-32201Same product: Microsoft Sharepoint Server
CVE-2026-20963Same product: Microsoft Sharepoint Server
CVE-2025-21344Same product: Microsoft Sharepoint Server
CVE-2026-26106Same product: Microsoft Sharepoint Server
CVE-2025-49701Same product: Microsoft Sharepoint Server
CVE-2025-59228Same product: Microsoft Sharepoint Server

References