Microsoft SharePoint CVE-2026-69282

The attacker must hold a valid, authenticated SharePoint account with at least low-level permissions (PR:L per CVSS) - unauthenticated network exploitation is not possible. No user interaction from a victim is required (UI:N), and no special non-default configuration or specific deployment mode is identified as a prerequisite. The attack is conducted entirely over the network (AV:N) against a reachable SharePoint Server endpoint. Exploitation is limited to Microsoft SharePoint Server Subscription Edition builds prior to 16.0.20326.20090; SharePoint Online (Microsoft 365) and earlier server editions are not confirmed affected. The primary limiting factor for external attackers is possession of valid SharePoint credentials - organizations with tightly provisioned user accounts and network-level access restrictions face meaningfully reduced exposure.

The CVSS 8.8 score accurately reflects a severe, network-exploitable vulnerability requiring only low-level authentication (PR:L) with full confidentiality, integrity, and availability impact and no user interaction. The low attack complexity (AC:L) means no race conditions, special timing, or environmental factors are needed, making exploit development a realistic concern. SharePoint Server is widely deployed as an enterprise document management and collaboration hub, often storing sensitive financial, legal, and operational data, which amplifies potential business impact. Any organization running the unpatched Subscription Edition - from large enterprises to smaller IT teams - should prioritize this patch. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, providing a narrow window for remediation before the exploitation barrier drops further.

An attacker holding a standard SharePoint contributor or site member account crafts a specially formed HTTP request targeting a SharePoint Server endpoint that fails to properly enforce access control boundaries. The request triggers a server-side code execution path restricted to higher-privilege operations, resulting in arbitrary code execution under the SharePoint server process context without any victim interaction. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) and network accessibility of SharePoint lower the bar for independent exploit development.