EUVD-2026-99046
GHSA-cwj8-fvhj-wqg5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged SharePoint account
-
ExploitSend crafted request with injected code
-
ExecutionTrigger code injection in SharePoint
-
ImpactElevate privileges on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated SharePoint account with at least low privileges (PR:L), reachable over the network to the SharePoint server; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The specific vulnerable feature or endpoint is not named in the description beyond improper control of code generation (CWE-94) within SharePoint, so the exact injectable surface should be confirmed against the MSRC advisory. The principal limiting factor is the authentication requirement - an unauthenticated outsider cannot directly exploit this and must first obtain or compromise a low-privileged SharePoint credential; no non-default configuration is stated as required. |
| Impact | This is a genuinely high-priority flaw rather than a high-CVSS-but-low-risk issue, though some key exploitation signals are absent. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) indicates network-reachable, low-complexity exploitation requiring only low privileges (PR:L) and no user interaction, with high impact to confidentiality, integrity, and availability - a strong profile for a post-authentication SharePoint attack, consistent with CWE-94 code injection. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no confirmation of active exploitation or weaponization. Exploitation status is therefore 'no public exploit identified at time of analysis.' The authentication requirement (PR:L) is the main mitigating factor and means an attacker needs at least a low-privileged valid SharePoint account, but given how commonly SharePoint accounts are broadly provisioned in enterprises, and SharePoint's historical record as an active exploitation target, this should be prioritized for patching. The description frames the outcome as 'elevate privileges' while the CVSS impact and code-injection nature imply code execution - these are consistent (code injection as the mechanism for privilege elevation), but the exact post-exploitation privilege boundary should be verified against the Microsoft advisory. |
| Exploit ScenarioDerived | An attacker with a low-privileged authenticated SharePoint account sends a crafted request to a vulnerable SharePoint endpoint that improperly handles input used in code generation, injecting attacker-controlled code. Because AV:N/AC:L/UI:N applies, this is a reliable network-based attack requiring no victim interaction, letting the attacker elevate privileges to a higher-privileged context on the server. No public exploit code is identified in the available data at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Authenticated code injection in Microsoft SharePoint (CVSS 3.1 base 8.8) allows a remote attacker holding a valid low-privileged SharePoint account to run code in the server's context and elevate privileges, with low attack complexity and no user interaction required. The flaw is rooted in improper control of code generation (CWE-94) inside SharePoint, and the assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that the authentication prerequisite is the primary barrier - an outside attacker must first obtain or compromise a low-privileged credential, after which confidentiality, integrity, and availability are all fully impacted. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, so this should be treated as a high-priority patch item rather than an actively exploited emergency; the specific vulnerable endpoint is not named in the description and should be confirmed against the Microsoft MSRC advisory.
RemediationAI
The primary remediation is to apply the Microsoft security update for CVE-2026-102863 as published in the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102863); no exact fixed build number was included in the input data, so the specific KB/cumulative update and the minimum patched version must be read from that advisory and installed on every SharePoint server in the farm, including application and web front-end roles, followed by the required IIS/SharePoint timer-job restart. Because exploitation requires only a valid low-privileged SharePoint account, the most effective compensating control while patching is to reduce the pool of usable credentials and the reach of the endpoint: enforce MFA, disable or tightly audit stale and guest/external accounts, and restrict network access to the SharePoint front ends (for example reverse-proxy or VPN/IP-allowlist for authenticated users) - the trade-off being reduced external collaboration and mobile access. Where the advisory identifies a specific vulnerable feature (web part, workflow, or customization path), disable that feature or block the corresponding handler until the update is deployed, accepting the loss of that functionality. Additional hardening with real but partial value: enable SharePoint auditing and Microsoft Defender/SIEM detections for anomalous process creation by w3wp.exe or unusual outbound connections from SharePoint servers, and run the SharePoint farm and its service accounts under least privilege so that post-exploitation code runs with the narrowest possible rights; these measures do not substitute for the patch and do not eliminate the code-injection path. Monitor the MSRC page for updates, as patch status for this CVE is not independently confirmed by the data provided in this record.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SharePoint is a Microsoft ASP.NET-based collaboration platform whose server-side components compile and execute dynamic code for web parts, workflows, page rendering, and administrative extensibility. CWE-94 (Improper Control of Generation of Code / Code Injection) describes the class of defects in which attacker-influenced input reaches a code-generation or dynamic-execution path - for example an unsafe expression/script evaluation, dynamic compilation of user-supplied content, or deserialization-driven code construction - without sufficient neutralization, so that the input is executed as code rather than treated as data. Here that class of defect sits inside SharePoint's own server logic, which is why the impact spans full confidentiality, integrity, and availability (C:H/I:H/A:H) within the unchanged security scope of the SharePoint application. The CVSS vector PR:L plus UI:N means an existing authenticated principal, even a low-privileged one, can trigger the code-generation path remotely over the network without tricking another user, which is the classic privilege-escalation-plus-RCE pattern in which a limited SharePoint user reaches the identity and privileges of the SharePoint server process. No CPE strings were supplied with this record, so the exact affected build range and the precise injectable surface (web part, workflow engine, site/page customization, or API endpoint) must be read off the MSRC update-guide entry for CVE-2026-102863 rather than inferred; equally, nothing in the available data states that any non-default configuration is required, so default deployments should be considered exposed to authenticated abuse.
Know when Sharepoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable (AV:N) low-complexity (AC:L) code injection needing a low-privileged account (PR:L) and no interaction, yielding full code execution and high C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
Microsoft SharePoint contains a high-severity code injection vulnerability (CVE-2026-102863) that could allow an attacker with a low-privileged account to execute arbitrary code on the server, potentially compromising the confidentiality, integrity, and availability of SharePoint data and services. While no public exploit has been identified at the time of analysis, the flaw poses a significant risk to organizations relying on SharePoint for collaboration and document management. Leadership should prioritize remediation planning and monitor vendor guidance, as a patch is not yet available.
No vendor-released patch identified at time of analysis. Interim mitigations include enforcing least privilege, monitoring for credential compromise, and consulting the Microsoft MSRC advisory for any workarounds or specific endpoint mitigations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Sharepoint
View allRemote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authen
SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190)
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.2
Authenticated path traversal in Microsoft SharePoint Server can be escalated to code execution over the network, allowin
Privilege escalation in Microsoft SharePoint Server Subscription Edition before build 16.0.20326.20190 allows a remote l
Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated remote attacker holding
Privilege elevation in Microsoft SharePoint Server Subscription Edition lets any attacker who already holds a valid low-
Privilege escalation in Microsoft SharePoint allows an authenticated low-privileged user to invoke functionality that la
Privilege escalation in Microsoft SharePoint allows an authenticated attacker with low-level privileges to gain elevated
Exploit-DB