Description
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
Published: 2026-10-13
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Microsoft Office OneNote is vulnerable to command injection due to the improper neutralization of special elements used in a command string. An attacker can supply crafted input that causes the application to execute arbitrary code, potentially compromising the host system. The weakness is identified as CWE‑77 and the impact is the execution of malicious code without authentication, however the vulnerability cannot be leveraged without remote access and proper input in OneNote documents.

Affected Systems

The affected product is Microsoft 365 Apps for Enterprise. No specific version information is disclosed; any installation of this Office suite that includes OneNote may be vulnerable until patched.

Risk and Exploitability

This flaw carries a CVSS score of 8.8, indicating a high severity. The EPSS score is not available, and the vulnerability is currently not listed in the CISA KEV catalog. The attack vector is inferred to be network‑based; an unauthorized remote attacker would need to deliver a malicious OneNote file or exploit a network connection to OneNote to trigger the command injection.

Generated by OpenCVE AI on October 14, 2026 at 12:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Microsoft Office update that addresses CVE‑2026‑97781.
  • Restrict OneNote document sharing to trusted users and verify documents before opening.
  • Disable automatic loading of external content or apply strict content security policies in OneNote.
  • Monitor system logs for anomalous command execution or unexpected privilege escalation activity.

Generated by OpenCVE AI on October 14, 2026 at 12:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*

Tue, 13 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Description Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
Title Microsoft Office OneNote Remote Code Execution Vulnerability
First Time appeared Microsoft
Microsoft 365 Apps
Weaknesses CWE-77
CPEs cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*
Vendors & Products Microsoft
Microsoft 365 Apps
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft 365 Apps
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-10-31T18:13:39.476Z

Reserved: 2026-09-25T04:32:19.232Z

Link: CVE-2026-97781

cve-icon Vulnrichment

Updated: 2026-10-13T19:32:04.967Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T19:22:16.197

Modified: 2026-10-16T15:17:38.370

Link: CVE-2026-97781

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T19:45:13Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')