What is the CVSS score of CVE-2026-26106?

CVE-2026-26106 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Sharepoint Server are affected by CVE-2026-26106?

A high-severity vulnerability in Microsoft Office SharePoint (CVE-2026-26106) allows authorized users to execute arbitrary code remotely, potentially leading to data breach, system compromise, or…. A patch is available.

How to fix or mitigate CVE-2026-26106?

Within 24 hours: Inventory all SharePoint instances and document authorized user accounts with elevated privileges; audit recent SharePoint access logs for suspicious activity. Within 7 days: Implement network segmentation to restrict SharePoint access to essential business users only; deploy WAF rules to block suspicious input patterns; disable unnecessary SharePoint features and extensions. Within 30 days: Establish a monitored vulnerability tracking process; prepare for rapid deployment once Microsoft releases a patch; conduct security awareness training for SharePoint administrators on social engineering and credential compromise.

Sharepoint Server CVE-2026-26106

HIGH

Improper Input Validation (CWE-20)

2026-03-10 secure@microsoft.com

Microsoft Information Disclosure Sharepoint Server

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 8.8

DescriptionCVE.org

Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft SharePoint Server allows authenticated users to bypass input validation and execute arbitrary code across the network. This high-severity vulnerability (CVSS 8.8) affects authorized attackers who can leverage improper validation controls to achieve full system compromise. No patch is currently available, making immediate mitigation and access controls critical for affected organizations.

Technical ContextAI

Classified as CWE-20 (Improper Input Validation). Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.