What is the CVSS score of CVE-2026-58277?

CVE-2026-58277 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Microsoft SharePoint are affected by CVE-2026-58277?

Organizations using Microsoft SharePoint Server 2016 or 2019 face elevated security risk from a privilege escalation flaw allowing authenticated users to circumvent access controls.. A patch is available.

How to fix or mitigate CVE-2026-58277?

Within 24 hours: Identify all Microsoft SharePoint Server 2016 and 2019 deployments in your environment and assess privilege levels of users with access to critical document libraries and sites. Within 7 days: Apply the vendor-released security patch from Microsoft to all affected SharePoint Server instances, beginning with production environments, and validate patch application through security scanning. Within 30 days: Conduct a privilege audit of SharePoint accounts to identify and remediate any unauthorized privilege escalations that may have occurred, and implement enhanced monitoring for abnormal privilege elevation activities.

Microsoft SharePoint CVE-2026-58277

EUVD-2026-44282 HIGH

Improper Authorization (CWE-285)

2026-07-14 microsoft

GHSA-qhm9-9gfp-672c

Authentication Bypass Microsoft Microsoft Sharepoint Enterprise Server 2016 Microsoft Sharepoint Server 2019

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

vuln.today AI

8.8 HIGH

Network-reachable authorization bypass usable by any authenticated low-privileged user (PR:L, AV:N, AC:L) with no interaction, granting high confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:53 vuln.today

CVE Published

Jul 14, 2026 - 17:09 nvd

HIGH 8.8

DescriptionCVE.org

Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated network attacker to abuse an improper authorization check to gain higher privileges within the SharePoint environment. The flaw is tagged as an authentication bypass and carries a CVSS 8.8, reflecting high impact to confidentiality, integrity, and availability from a low-privileged starting point. Microsoft has released a patch; there is no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

The vulnerability is rooted in CWE-285 (Improper Authorization), meaning SharePoint fails to correctly verify that the requesting principal is permitted to perform a given action before executing it. Microsoft SharePoint Server is an on-premises collaboration and document-management platform built on ASP.NET/IIS that enforces object- and site-level permission models; a broken authorization check in that model lets an already-authenticated user perform operations reserved for higher-privileged accounts. Per the CPE data, the affected components are the on-premises products Microsoft SharePoint Enterprise Server 2016 and Microsoft SharePoint Server 2019, not the SharePoint Online/Microsoft 365 service.

RemediationAI

Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-58277 to all SharePoint Enterprise Server 2016 and SharePoint Server 2019 farm servers, following the guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58277 and confirming the exact fixed build for your product from that page. SharePoint updates typically require running the SharePoint Products Configuration Wizard (or PSConfig) across every server in the farm after installing the binaries, so schedule a maintenance window and validate farm health afterward. As compensating controls until patching completes, restrict network access to SharePoint web front-ends to trusted users/segments, tighten and audit low-privilege account membership since exploitation requires an authenticated foothold, and monitor SharePoint ULS and IIS logs for anomalous privilege-changing or unauthorized object-access activity; note these controls reduce but do not eliminate risk from a valid low-privileged account.