Microsoft SharePoint CVE-2026-58639

Exploitation requires a valid SharePoint user account with at least basic authenticated access to the target SharePoint installation - the CVSS PR:L metric and the description's 'authorized attacker' language both confirm this. No special administrative privileges or elevated roles are described as necessary. The attack is fully network-accessible (AV:N) with low complexity (AC:L) and requires no user interaction from a victim. Exploitation is limited to contexts where the attacker can supply URLs or URIs to a SharePoint server-side processing feature; deployments that restrict authenticated access to SharePoint entirely (e.g., intranet-only with no external user access) have a meaningfully reduced exposure surface. The scope-unchanged (S:U) metric indicates that exploitation does not inherently break out of the SharePoint application context, but the attacker's ability to reach internal network resources depends on the network position and firewall posture of the SharePoint host.

The CVSS base score of 6.5 reflects medium severity, driven primarily by the high confidentiality impact and the low-privilege, network-accessible attack vector with low complexity. The S:U (scope unchanged) metric indicates that damage is contained within the SharePoint application boundary rather than affecting adjacent systems directly - though SSRF is frequently used as a pivot to reach internal services, which is a real-world escalation risk not fully captured by this vector alone. No EPSS score was provided in the intelligence data, so exploitation probability cannot be quantified with that signal. The CVE is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, meaning active exploitation has not been confirmed. The 'authorized attacker' prerequisite (PR:L) limits blast radius compared to unauthenticated SSRF, but in large SharePoint deployments with broad user bases or guest access, this threshold is easily met. The primary risk is lateral movement to internal infrastructure and credential theft from cloud metadata services, making this a medium-priority issue for organizations with SharePoint exposed to untrusted authenticated users or with sensitive internal resources reachable from the SharePoint host.

An authenticated SharePoint user with a standard account submits a crafted request through a URL-accepting SharePoint feature - such as an external content type, custom web part, or REST-based connector - supplying an internal IP address or cloud instance metadata URL (e.g., http://169.254.169.254/latest/meta-data/) as the target. The SharePoint server dutifully fetches the specified resource and may return the response content to the attacker, disclosing internal service banners, instance credentials, or network topology. No public proof-of-concept is known at time of analysis, but SSRF patterns on SharePoint are well-documented in offensive security literature and the low attack complexity suggests straightforward reproduction once a vulnerable URL-processing endpoint is identified.