Microsoft SharePoint CVE-2026-58277

Exploitation requires the attacker to already hold valid authenticated access to the on-premises SharePoint site (CVSS PR:L), so this is not a pre-authentication attack; a low-privileged SharePoint account such as a standard site user is the concrete prerequisite. The target must be Microsoft SharePoint Enterprise Server 2016 or SharePoint Server 2019 reachable over the network (AV:N), and no user interaction and no special non-default feature toggle is indicated by the available data. The primary limiting factor is the need for prior authentication with at least low privileges; there is no evidence a specific non-default configuration is required, but Microsoft's advisory should be checked to confirm affected configurations and builds.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding high impact across all three security properties - a genuinely high-priority profile for any organization running on-prem SharePoint. The key limiting signal is PR:L: the attacker must already hold a valid low-privileged SharePoint account, so this is a privilege-escalation primitive rather than a pre-auth breach, which narrows the realistic attacker set to insiders or anyone who has obtained low-tier credentials. No EPSS score, KEV status, or POC was provided in the input, so exploitation probability cannot be quantified; the absence of these signals should not be read as low risk given SharePoint's history of being targeted and chained. Overall this warrants prompt patching, but it is not confirmed to be under active exploitation.

An attacker who has obtained or been granted a low-privileged SharePoint account (for example a standard site member, or a compromised employee credential) sends crafted requests to the SharePoint web application that invoke a function whose authorization check is flawed. Because the check fails to enforce the required privilege level, the attacker performs actions reserved for administrators or higher-tier users, escalating their effective privileges within the farm. No public proof-of-concept was identified at time of analysis, and no user interaction is required.