Microsoft SharePoint CVE-2026-69943

Exploitation requires the attacker to hold valid authenticated access to the SharePoint deployment (CVSS PR:L), meaning an existing low-privileged user account or stolen credentials - this is the primary limiting factor and excludes purely anonymous internet attackers. Given AV:N/AC:L/UI:N, once authenticated the attacker needs only network reachability to the SharePoint web endpoint and no victim interaction or special timing. The affected deployments are on-premises Microsoft SharePoint Server Subscription Edition (below build 16.0.20326.20190), SharePoint Server 2019, and SharePoint Enterprise Server 2016; the description names no additional non-default feature toggle, so default authenticated configurations of these versions appear exploitable. The restricting factors defenders should weigh are: the authentication requirement, internal-only exposure if the SharePoint instance is not internet-facing, and the lack of any automatable/mass-exploitation indicator (SSVC Automatable=no).

This is a credible, above-average-priority vulnerability but not an emergency based on current signals. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable path traversal that an authenticated (PR:L) attacker can leverage with low complexity and no user interaction to achieve full confidentiality, integrity, and availability impact - consistent with remote code execution on the SharePoint server. The signals are internally consistent rather than conflicting: SSVC reports Exploitation=none and Automatable=no, which aligns with the absence of any KEV listing and any public POC, so the real-world exploitation pressure is currently low despite the high technical impact (SSVC Technical Impact=total matches C/I/A:H). The one tension worth noting is that PR:L requires the attacker to already hold a valid SharePoint account, which meaningfully narrows the attacker population versus an unauthenticated flaw - a factor the 8.8 score alone understates. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Net: treat as a high-value patch target (SharePoint has historically attracted rapid weaponization once details surface), but there is no evidence of active exploitation or automatable mass exploitation at time of analysis.

An attacker who already possesses low-privileged authenticated access to a SharePoint site (e.g., a standard user account or a compromised credential) sends a crafted request containing a traversal sequence that escapes the restricted directory, causing the server to process attacker-controlled content and execute code in the SharePoint server context over the network. No user interaction is required and attack complexity is low. No public exploit code has been identified at time of analysis, so exploitation would currently require independent development.