high8.8
CVE-2026-97781
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code…
Impact
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Microsoft 365 Apps For Enterprise | from 16.0.1 before https://aka.ms/OfficeSecurityReleases |
| Microsoft | 365 Apps | All versions |