EUVD-2026-44043
GHSA-hc2f-r46j-4w6x
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Missing authentication on a network-reachable critical function gives remote unauthenticated access (AV:N/AC:L/PR:N/UI:N) with privileged control yielding high C/I/A; scope unchanged within the farm.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets an unauthenticated network attacker reach a security-critical function that lacks any authentication check (CWE-306), gaining elevated privileges on the target farm. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code, and its CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects fully remote, unauthenticated exploitation with high confidentiality, integrity, and availability impact. Microsoft has released a patch via MSRC.
Technical ContextAI
SharePoint is Microsoft's enterprise web collaboration and document-management platform, typically deployed as internet- or intranet-facing IIS/ASP.NET web front-ends backed by SQL Server. The root cause is CWE-306 (Missing Authentication for a Critical Function): a network-reachable endpoint or operation that performs a privileged action does not verify the caller's identity, so requests are honored as if authenticated. The affected CPEs identify the on-premises server family - cpe:2.3:a:microsoft:microsoft_sharepoint_enterprise_server_2016, microsoft_sharepoint_server_2019, and microsoft_sharepoint_server_subscription_edition - meaning classic on-prem farms rather than SharePoint Online. Because SharePoint runs privileged service/application-pool identities and exposes numerous web services, an unauthenticated privileged operation can typically be leveraged toward broader farm compromise.
RemediationAI
Apply the vendor security update: Patch available per Microsoft advisory - install the SharePoint security update referenced in the MSRC Security Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164) for each affected build (Enterprise Server 2016, Server 2019, and Subscription Edition), following Microsoft's guidance to run the update wizard/PSConfig so the fix is fully applied across the farm. Because this is confirmed actively exploited, patch on an emergency timeline and, if the farm was internet-exposed, assume potential compromise and hunt for indicators. If immediate patching is impossible, reduce exposure with compensating controls: remove direct internet exposure of the SharePoint web front-ends and place them behind a VPN or authenticated reverse proxy/WAF that can filter anonymous requests to the affected endpoint (trade-off: may break legitimate external/anonymous access such as extranet or public sites); restrict inbound access to trusted management networks; and increase monitoring of IIS and SharePoint ULS logs for anomalous unauthenticated requests. These controls narrow the attack surface but are not a substitute for the patch given a public exploit exists.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today