Microsoft SharePoint CVE-2026-70217

Exploitation requires an attacker to already possess high-privilege authenticated access (PR:H) to a Microsoft SharePoint Server Subscription Edition farm running a build below 16.0.20326.20190; once authenticated, the request is made over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). The limiting factor is the high-privilege prerequisite: an unprivileged or anonymous attacker cannot exploit this, which substantially narrows the realistic threat to privileged insiders or attackers who have already compromised a privileged account. Impact is limited to disclosure of confidential information only (no integrity or availability effect).

This is a moderate-severity, authenticated information-disclosure flaw (CVSS 4.9) that is unlikely to be an urgent priority for most environments. The CVSS vector agrees across signals pointing to a constrained issue: although the attack vector is network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), it requires high privileges (PR:H), so the attacker must already hold a privileged, authenticated position on the SharePoint deployment. Impact is confined to confidentiality (C:H) with no integrity or availability effect (I:N/A:N) and no scope change (S:U). CISA's SSVC framework reinforces low urgency: Exploitation=none, Automatable=no, Technical Impact=partial. No EPSS score was supplied in the input, and there is no KEV listing and no public proof-of-concept, so there is no public exploit identified at time of analysis. The combination of a high-privilege prerequisite plus confidentiality-only impact means this is a high-CVSS-relevant-but-low-real-risk issue for well-administered environments; the main concern is a privileged insider or an attacker who has already compromised a privileged account using the flaw to reach data otherwise segregated by access controls. Note the 'Authentication Bypass' input tag conflicts with the data: the description states an 'authorized attacker' and the vector requires PR:H, so this is an authenticated access-control failure, not an authentication bypass - verify the tag against the vendor advisory.

An attacker who already holds a high-privilege, authenticated account on a SharePoint Server Subscription Edition farm sends crafted requests over the network to reach content the improper access-control check should have withheld. Because exploitation is confined to confidentiality, the result is disclosure of sensitive site or configuration data rather than code execution or tampering. No public exploit code has been identified, and CISA SSVC rates exploitation as 'none' and non-automatable.