EUVD-2026-99073
GHSA-whmw-7r3h-8xrq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege SharePoint credentials
-
ExploitSend crafted request over network
-
ExecutionTrigger improper input validation flaw
-
ImpactRead unauthorized sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires a valid low-privilege authenticated session against Microsoft SharePoint Server Subscription Edition (versions 16.0.0 prior to 16.0.20326.20190), consistent with PR:L in the CVSS vector - it is NOT exploitable by fully unauthenticated attackers. The attacker crafts input that the server fails to validate properly (CWE-20) to disclose information. Limiting factors: the requirement for prior authentication (even if low-privilege) and the confidentiality-only impact (no integrity or availability effect) reduce realistic risk; the server must be network-reachable to the attacker. No special non-default configuration is named in the description. |
| Impact | This is a moderate-priority information disclosure vulnerability (CVSS 6.5) in Microsoft SharePoint Server Subscription Edition, not a top-tier emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates network-reachable, low-complexity exploitation requiring low-level authentication (PR:L), no user interaction, with high confidentiality impact but zero integrity or availability impact. No EPSS score, SSVC decision data, or POC evidence was provided in the input, and the CVE is not listed in CISA KEV, so there is no signal of active or widespread exploitation at this time. The signals are internally consistent - there is no network-vs-local or auth conflict - but the key risk-prioritization inputs (EPSS exploitation probability and SSVC automatable/exploitation status) are MISSING, so real-world exploitation likelihood cannot be quantified from the data provided. Because exploitation requires an already-authenticated (low-privilege) foothold and yields only read access, this leans toward a post-authentication data-leak issue rather than a pre-auth critical, but the high deployment footprint of SharePoint in enterprises warrants timely patching. |
| Exploit ScenarioDerived | A low-privileged authenticated user (or an attacker who has obtained valid low-privilege SharePoint credentials, e.g., via phishing) sends crafted requests over the network to the SharePoint server, abusing improper input validation (CWE-20) to read information they should not be able to access. No user interaction and only low privileges are required per the CVSS vector, but no public exploit code was identified in the provided data, so exploitation would require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Improper input validation in Microsoft SharePoint Server Subscription Edition (versions 16.0.0 prior to 16.0.20326.20190) allows an attacker holding a valid low-privilege authenticated session to disclose confidential information over the network, with a CVSS 3.1 base score of 6.5. Because the vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the weakness is remotely reachable and trivially triggered once a session exists, but it cannot be exploited by a fully unauthenticated attacker and produces no integrity or availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a moderate-priority patch-and-monitor item rather than an emergency, though the high confidentiality rating means successful abuse could expose content the attacker is not entitled to read, and the affected server must be network-accessible to the attacker for exploitation.
RemediationAI
Vendor-released patch: upgrade Microsoft SharePoint Server Subscription Edition to build 16.0.20326.20190 or later; the fix is available from the vendor and the definitive installation guidance and download links are in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105719. Apply the cumulative update through the standard SharePoint patching workflow (run the installer on each farm server, then run the SharePoint Products Configuration Wizard), and verify the resulting build number afterwards, since the patch is delivered as a build-level cumulative update and a partial farm upgrade can leave servers inconsistent. If immediate patching is not possible, compensating controls should be chosen with their trade-offs in mind: restrict who can obtain authenticated sessions and trim site collection and web application permissions so PR:L exposure is limited to the smallest population (costs administrative effort and may disrupt legitimate collaboration); place the SharePoint front end behind an authenticated reverse proxy or VPN so only trusted networks can reach it (reduces external exposure but breaks external sharing and mobile access); and enable audit logging on document libraries and search/REST endpoints so anomalous data retrieval by low-privilege accounts can be detected (adds log volume and storage overhead without preventing exploitation). Because the impact is confidentiality-only and requires prior authentication, aggressive blocking of legitimate content access is generally not warranted, but monitoring for unusual read patterns from low-privilege accounts is a reasonable interim measure. There is no public exploit identified at time of analysis, so patching can follow a normal change window rather than an emergency process.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-20, improper input validation, in Microsoft SharePoint Server Subscription Edition, the subscription-based on-premises release of SharePoint whose build numbers track the 16.0.x line. SharePoint is an ASP.NET-based collaboration platform whose web front end accepts user-supplied input through forms, list operations, REST/CSOM endpoints, web parts, and query parameters, then mediates access to content stored in its content database. When input reaching one of these surfaces is not validated or normalized correctly, the server can be induced to return data outside the caller's intended authorization scope, yielding a confidentiality-only disclosure rather than code execution or tampering. The assessed CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N maps precisely onto that behavior: network attack vector, low attack complexity, low privileges required (a valid authenticated session, consistent with PR:L), no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. The weakness is present in Microsoft SharePoint Server Subscription Edition builds earlier than 16.0.20326.20190; adjacent SharePoint products such as Server 2016 and 2019 are not listed as affected by the available EUVD data, so affected-version scoping should be verified against the MSRC update guide before broad patching.
Know when Sharepoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable (AV:N) low-complexity attack needing a low-privilege authenticated session (PR:L); improper input validation leaks data, so C:H with no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper input validation in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Sharepoint
View allRemote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authen
SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted
Authenticated code injection in Microsoft SharePoint (CVSS 3.1 base 8.8) allows a remote attacker holding a valid low-pr
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190)
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.2
Authenticated path traversal in Microsoft SharePoint Server can be escalated to code execution over the network, allowin
Privilege escalation in Microsoft SharePoint Server Subscription Edition before build 16.0.20326.20190 allows a remote l
Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated remote attacker holding
Privilege elevation in Microsoft SharePoint Server Subscription Edition lets any attacker who already holds a valid low-
Privilege escalation in Microsoft SharePoint allows an authenticated low-privileged user to invoke functionality that la
Exploit-DB