What is the CVSS score of CVE-2026-55052?

CVE-2026-55052 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Microsoft Sharepoint Enterprise Server 2016 are affected by CVE-2026-55052?

Microsoft SharePoint Server (2016, 2019, and Subscription Edition) contains a privilege escalation vulnerability allowing authenticated users to gain unauthorized administrative access by bypassing…. A patch is available.

How to fix or mitigate CVE-2026-55052?

Within 24 hours, identify all Microsoft SharePoint Server instances running 2016, 2019, or Subscription Edition and test the vendor-released patch in non-production environments to validate compatibility with existing configurations and extensions. Within 7 days, deploy the patch to production SharePoint systems in accordance with your change management procedures, prioritizing systems that store sensitive business data. Complete patching across all affected SharePoint editions within 30 days, and verify successful deployment through vendor validation and internal security testing.

Microsoft Sharepoint Enterprise Server 2016 CVE-2026-55052

EUVD-2026-44222 HIGH

Missing Authorization (CWE-862)

2026-07-14 microsoft

GHSA-gvwf-xx95-q66f

Authentication Bypass Microsoft Microsoft Sharepoint Enterprise Server 2016 Microsoft Sharepoint Server 2019 Microsoft Sharepoint Server Subscription Edition

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 19:24 vuln.today

CVE Published

Jul 14, 2026 - 17:09 cve.org

HIGH 8.8

DescriptionCVE.org

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets an already-authenticated network user gain higher privileges by exploiting a missing authorization check (CWE-862). Any low-privileged account with access to the SharePoint web application can abuse the flaw to perform actions reserved for higher-privileged roles, with full confidentiality, integrity, and availability impact per the CVSS 8.8 rating. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.