CVE-2020-16944: 
vulnerability analysis and mitigation

A security vulnerability (CVE-2020-16944) was identified in Microsoft SharePoint products that could allow remote code execution if a user opens a specially crafted Office file. The vulnerability was disclosed and patched on October 13, 2020, affecting SharePoint Server 2019, SharePoint Foundation 2013 SP1, and SharePoint Enterprise Server 2016 (Microsoft Support).

The vulnerability was addressed as part of Microsoft's October 2020 security updates. The fix was included in security update packages KB4486677 for SharePoint Enterprise Server 2016, KB4486694 for SharePoint Foundation 2013, and KB4486676 for SharePoint Server 2019 (Microsoft Support).

If successfully exploited, the vulnerability could allow an attacker to execute arbitrary code in the context of the SharePoint application pool and SharePoint server farm account by creating a specially crafted Office file (Microsoft Support).

Microsoft released security updates to address this vulnerability. Users can obtain the update through several methods: 1) Microsoft Update with automatic updating enabled, 2) Microsoft Update Catalog for standalone package, or 3) Microsoft Download Center. For SharePoint Enterprise Server 2016, users must have the release version installed before applying the security update (Microsoft Support).