EUVD-2026-44233
GHSA-p7vq-vr5c-p2r6
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-accessible spoofing requiring valid low-privilege credentials; partial confidentiality and integrity impact only, no availability or scope change.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Spoofing vulnerability in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition allows an authenticated network attacker to impersonate identities or forge content due to improper access control (CWE-284). Exploitation requires valid credentials (CVSS PR:L), limiting opportunistic attack surface. SSVC assessment confirms no active exploitation, and EPSS sits at just 0.28% (20th percentile), consistent with a targeted rather than broadly exploited vulnerability. Vendor-released patches are available for all three affected product lines.
Technical ContextAI
The affected products - identified via CPE strings cpe:2.3:a:microsoft:microsoft_sharepoint_enterprise_server_2016, cpe:2.3:a:microsoft:microsoft_sharepoint_server_2019, and cpe:2.3:a:microsoft:microsoft_sharepoint_server_subscription_edition - are Microsoft's on-premises enterprise collaboration and document management platforms. CWE-284 (Improper Access Control) as the root cause indicates that SharePoint fails to enforce sufficient authorization boundaries on certain network operations, allowing an authenticated user to make the server treat their requests as originating from a different, potentially more privileged identity. This class of flaw typically manifests in session token handling, request routing, or identity assertion layers where the platform does not rigorously validate the claimed source or user context of a network request.
RemediationAI
Apply the vendor-released patches immediately: upgrade SharePoint Enterprise Server 2016 to build 16.0.5561.1001 or later, SharePoint Server 2019 to 16.0.10417.20175 or later, and SharePoint Server Subscription Edition to 16.0.19725.20434 or later. Full patch details and download links are available through the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56157. As a compensating control prior to patching, network-level access controls restricting SharePoint to known, trusted authenticated user segments can reduce exposure - note this does not eliminate the vulnerability but raises the bar for exploitation by limiting which authenticated accounts can reach the affected service. Monitoring SharePoint audit logs for anomalous identity assertion patterns may help detect exploitation attempts.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today