Skip to main content

Sharepoint Server CVE-2026-20951

HIGH
Improper Input Validation (CWE-20)
2026-01-13 secure@microsoft.com
Microsoft Sharepoint Server
7.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker crafts malicious Office document
  2. Exploit
    User opens file in SharePoint
  3. Execution
    Input validation bypassed in parser
  4. Impact
    Arbitrary code executes with user privileges

Vulnerability Assessment

Weakness
CWE
CWE-20
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions

User interaction required: victim must open attacker-supplied Office document in Microsoft Office SharePoint environment. No authentication or special configuration needed beyond default SharePoint installation.
Impact

CVSS 7.8 (HIGH). Attack vector: Local. Complexity: Low. Privileges required: None. User interaction: Required. Exploitation no authentication required. Exploitable via local access.
Exploit ScenarioDerived

An attacker without authentication could exploit this vulnerability to compromise the affected system.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Local code execution in Microsoft SharePoint Server results from inadequate input validation, enabling attackers with local access to execute arbitrary code with user interaction. The vulnerability affects SharePoint deployments and carries high impact across confidentiality, integrity, and authenticity. No patch is currently available.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:54 CVSS 7.8

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally. [CVSS 7.8 HIGH]

RemediationAI

Monitor vendor advisories for a patch.

Affected Packages

microsoft sharepoint_enterprise_server_2016_16_0_5535_1001 fix: Microsoft SharePoint Enterprise Server 2016 16.0.5535.1001
microsoft sharepoint_server_2019_16_0_10417_20083 fix: Microsoft SharePoint Server 2019 16.0.10417.20083
microsoft sharepoint_server_subscription_edition_16_0_19127_20442 fix: Microsoft SharePoint Server Subscription Edition 16.0.19127.20442

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in microsoft

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-20 (Improper Input Validation). Affects Sharepoint Server. Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.

Know when Sharepoint Server gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ENISA EUVD HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.

Executive ViewAI

Why It Matters

Organizations using Improper input validation in Microsoft Office SharePoint face notable risk from CVE-2026-20951, a input validation vulnerability rated CVSS 7.8. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score
0.1%
Top 81% exploitable
Threat Intel
1
1 source
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS NCSC-NL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: +5

Affected Products (CPE)CVE.org

cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*
cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*
cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*

More in Sharepoint Server

View all
CVE-2025-53770 CRITICAL POC
9.8 Jul 20

Microsoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
CVE-2025-49704 HIGH POC
8.8 Jul 08

Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
CVE-2025-49706 MEDIUM POC
6.5 Jul 08

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
CVE-2023-21716 CRITICAL POC
9.8 Feb 14

Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
CVE-2013-1315 CRITICAL POC
9.3 Sep 11

Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
CVE-2015-2468 CRITICAL POC
9.3 Aug 15

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
CVE-2015-0064 CRITICAL POC
9.3 Feb 11

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
CVE-2013-1330 CRITICAL
10.0 Sep 11

The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
CVE-2026-65660 HIGH POC
8.8 Aug 11

Code injection (CWE-94) in Microsoft SharePoint Server exposes authenticated network users to high-impact compromise acr
CVE-2013-0006 HIGH
8.8 Jan 09

Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
CVE-2013-3889 CRITICAL
9.3 Oct 09

Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
CVE-2013-3858 CRITICAL
9.3 Sep 11

Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

References

Advisories & patches
ADVISORY https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20951

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy