CVE-2026-47294

HighCVSS 8.0/10Last modified Jul 22, 2026

Description

Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Jun 1, 2026
Last modified
Jul 22, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-472958.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate CVE-2026-472967.5Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate CVE-2026-472978.1Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.CVE-2026-472988.0Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-472997.2Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent allows an authorized attacker to CVE-2026-47306.4The Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website plugin for WordPress is vulnerable to Stored Cross-SiCVE-2026-473008.8Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.CVE-2026-473018.8Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.CVE-2026-473027.5Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-473038.8Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.CVE-2026-473049.8Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-473057.8Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.
CVE-2026-47294: High severity, CVSS 8.0 | Vulnix