EUVD-2026-29647
GHSA-hgxw-5xv9-c3cc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable web app exploitable by any authenticated low-privilege user without interaction (AV:N/AC:L/PR:L/UI:N), yielding total code-execution impact (C:H/I:H/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Insufficient granularity of access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Articles & Coverage 1
AnalysisAI
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated attacker with low-privilege access to execute arbitrary code across the network by abusing insufficiently granular access controls (CWE-1220). The flaw carries a CVSS 8.8 rating with full confidentiality, integrity, and availability impact; however EPSS estimates only a 0.06% exploitation probability and CISA SSVC records no observed exploitation, so this is currently no public exploit identified at time of analysis. Microsoft has released patches for all affected editions.
Technical ContextAI
SharePoint is Microsoft's enterprise collaboration and document-management platform, typically deployed as an on-premises web application farm (IIS/ASP.NET) exposed to authenticated organizational users. The root cause is CWE-1220, Insufficient Granularity of Access Control, meaning the product enforces authorization at too coarse a level and fails to distinguish operations that should require higher privileges. The CPE data confirms the affected components are the server products microsoft_sharepoint_enterprise_server_2016, microsoft_sharepoint_server_2019, and microsoft_sharepoint_server_subscription_edition (not SharePoint Online). Because a low-privilege authenticated principal can reach code paths that should be restricted, the coarse access model lets an ordinary user escalate to arbitrary code execution on the server.
RemediationAI
Apply the Microsoft security update for your edition to reach or exceed the fixed builds: SharePoint Enterprise Server 2016 to 16.0.5552.1002, SharePoint Server 2019 to 16.0.10417.20128, and SharePoint Server Subscription Edition to 16.0.19725.20280 (Patch available per vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40365). Because exploitation requires an authenticated low-privilege account, interim compensating controls where immediate patching is not possible include tightening SharePoint user permission levels and site-collection membership to remove unnecessary low-privilege accounts, restricting network reachability of the SharePoint web front-ends to trusted internal segments or via VPN/reverse-proxy so anonymous or broad access is not possible, and enforcing least-privilege on farm and web-application policy - with the trade-off that overly aggressive permission restriction can break legitimate collaboration workflows. Monitor authentication and IIS/ULS logs for anomalous privileged actions from standard accounts until the update is deployed.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today