CVE-2026-20941

HighCVSS 7.8/10Last modified Jul 30, 2026

Description

Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

No affected versions have been published.

Timeline

Published
Jan 13, 2026
Last modified
Jul 30, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-209437.0Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-209448.4Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-209455.4Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attCVE-2026-209467.8Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-209478.8Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attCVE-2026-209487.8Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-209497.8Improper access control in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally.CVE-2026-20959.8Agentflow developed by Flowring has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to exploit a specific CVE-2026-209507.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-209517.8Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.CVE-2026-209528.4Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-209538.4Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2026-20941: High severity, CVSS 7.8 | Vulnix