EUVD-2026-56293
GHSA-cw6m-53jc-774g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable via SharePoint web interface, low complexity, requires one valid authenticated account (PR:L); full C/I/A reflects attainable admin-level privilege post-escalation.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Microsoft SharePoint allows an authenticated low-privilege attacker to elevate to higher permissions over a network, exploiting improper authentication logic (CWE-287). Three on-premises SharePoint versions are confirmed affected - Enterprise Server 2016, Server 2019, and the current Subscription Edition - with vendor-released patches available for all. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 score and full High C/I/A impact profile make this a serious priority for organizations running unpatched on-premises SharePoint.
Technical ContextAI
CWE-287 (Improper Authentication) indicates the authentication validation logic within SharePoint fails to adequately verify the identity or permission level of a requester, allowing a lower-privileged principal to be treated as higher-privileged. The attack is network-based (AV:N), consistent with SharePoint's web-facing architecture over HTTP/HTTPS. Affected CPE covers Microsoft SharePoint Enterprise Server 2016 (all builds prior to 16.0.5565.1001), SharePoint Server 2019 (prior to 16.0.10417.20198), and SharePoint Server Subscription Edition (prior to 16.0.19725.20522) - all the currently supported on-premises product lines. The flaw is classified under the broad authentication bypass tag, suggesting the issue lies in how SharePoint evaluates permission tokens or role assertions during a network request rather than in transport or cryptographic controls.
RemediationAI
Organizations should apply the vendor-released patches immediately: upgrade SharePoint Enterprise Server 2016 to build 16.0.5565.1001 or later, SharePoint Server 2019 to build 16.0.10417.20198 or later, and SharePoint Server Subscription Edition to build 16.0.19725.20522 or later. Patch details and download links are available via the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62827. As a compensating control prior to patching, organizations may consider restricting SharePoint access to known internal IP ranges at the network perimeter to raise the bar for exploitation - note this does not eliminate risk from insider threats or compromised internal accounts. Tightening SharePoint site collection administrator and user group memberships to the minimum required can also limit the blast radius of a successful privilege escalation. Monitoring SharePoint Unified Audit Logs for unexpected permission changes or role assignments can serve as a detection mechanism while patching is underway.
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Ap
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today