What is the CVSS score of CVE-2026-47298?

CVE-2026-47298 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Sharepoint Server are affected by CVE-2026-47298?

Microsoft Office SharePoint contains a remote code execution vulnerability (CVE-2026-47298, CVSS 8.0) that enables authenticated users with low privilege levels to execute arbitrary code, affecting…. A patch is available.

How to fix or mitigate CVE-2026-47298?

Within 24 hours: Conduct complete inventory of SharePoint deployments; audit and restrict user account access to essential personnel only. Within 7 days: Implement network segmentation isolating SharePoint infrastructure; deploy comprehensive logging and real-time alerting for suspicious authentication and code execution patterns. Within 30 days: Establish patch timeline with Microsoft; develop and test upgrade or migration strategy for affected SharePoint versions.

Sharepoint Server CVE-2026-47298

EUVD-2026-35505 HIGH

Improper Authorization (CWE-285)

2026-06-09 secure@microsoft.com

GHSA-wqxq-vm25-4v8f

Authentication Bypass Microsoft Sharepoint Server

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 17:55 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 8.0

DescriptionNVD

Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Office SharePoint enables an authenticated attacker with low privileges to execute arbitrary code over the network when a victim user is induced to perform an action. The flaw stems from an improper authorization check (CWE-285) that fails to enforce expected access boundaries, yielding full confidentiality, integrity, and availability impact (CVSS 8.0). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.