EUVD-2026-100170
GHSA-vqjg-x6qf-fxr4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege SharePoint account
-
DeliverySend crafted request to vulnerable endpoint
-
ExploitBypass server-side authorization check
-
ExecutionExecute privileged action as elevated role
-
ImpactFull compromise of SharePoint data and services
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess valid low-privilege authenticated access to the SharePoint server (CVSS PR:L), after which the broken authorization check can be abused remotely over the network with low complexity and no user interaction. The limiting factor is this authentication prerequisite - fully unauthenticated attackers cannot exploit it - but in typical deployments many legitimate users (and any attacker with stolen or self-registered low-tier credentials) already meet it. Affected scope is Microsoft SharePoint Server Subscription Edition 16.0.0 prior to build 16.0.20326.20190; patched builds are not exploitable. |
| Impact | This is a credible, actionable priority rather than a paper tiger. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a low-complexity network-reachable privilege escalation that requires only low-level authenticated access and no user interaction, yielding high confidentiality, integrity, and availability impact - consistent with the SSVC 'Technical Impact: total' rating. Signals partially conflict on urgency: SSVC lists 'Exploitation: none' and 'Automatable: no', and there is no CISA KEV listing and no confirmed POC, so there is no public exploit identified at time of analysis and no evidence of in-the-wild use yet. The combination of an easy post-authentication vector against a high-value collaboration server (where many users already hold the required low privileges) plus a vendor patch (which enables attacker patch-diffing) means exploitation likelihood will rise over time even though it is not automatable today. EPSS was not provided in the input, so probabilistic exploitation scoring could not be incorporated. Net: patch on a normal-to-expedited cycle; the barrier is authentication, not complexity. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege SharePoint account (for example a standard site member, or a foothold from phished credentials) sends crafted requests over the network that exploit the broken authorization check (CWE-863) to perform actions reserved for higher-privileged roles. Because AC:L and UI:N, no special timing or victim interaction is needed, and success grants full control (C:H/I:H/A:H) over SharePoint content and services. No public exploit code has been identified at time of analysis, so this scenario is inferred from the CVSS vector and incorrect-authorization weakness. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Privilege escalation in Microsoft SharePoint Server Subscription Edition before build 16.0.20326.20190 allows a remote low-privilege authenticated attacker to abuse an incorrect authorization check and gain elevated privileges. The flaw is network-reachable with low complexity and no user interaction, and it can result in high confidentiality, integrity, and availability impact (CVSS 8.8, PR:L). No public exploit was identified at time of analysis and CISA SSVC records exploitation as none and automatable as no; the vendor patch is available, and patched builds are not exploitable.
RemediationAI
Apply the vendor-released patch from Microsoft's update guide, upgrading Microsoft SharePoint Server Subscription Edition to build 16.0.20326.20190 or later. The advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70246. If patching must be delayed, restrict access to the SharePoint service to trusted users and enforce least privilege, because exploitation requires valid low-privilege authenticated access; the trade-off is reduced collaboration for legitimate users. Monitor for anomalous privilege escalation or authorization bypass activity. No other specific workaround is supplied in the available source data; because this is an incorrect authorization flaw, access restrictions reduce exposure but do not fix the underlying issue.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a broken authorization issue (CWE-863) in Microsoft SharePoint Server Subscription Edition, meaning the application does not correctly enforce whether an authenticated user is permitted to perform an action or access a resource. SharePoint is a web-based collaboration platform, and the vulnerable authorization logic can be reached remotely over the network after a user has authenticated with low privileges; successful abuse leads to privilege elevation with high confidentiality, integrity, and availability impact. The CVSS vector shows AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, confirming that no special preconditions beyond valid low-privilege authentication are required, attack complexity is low, no user interaction is needed, and scope is unchanged. EUVD lists Microsoft SharePoint Server Subscription Edition 16.0.0 before 16.0.20326.20190 as affected; no CPE string was supplied in the available input data.
Know when Sharepoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable (AV:N), low complexity (AC:L), requires an existing low-privilege account for the incorrect-authorization flaw (PR:L), no interaction (UI:N), total impact (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
Microsoft SharePoint Server Subscription Edition contains a high-severity privilege escalation vulnerability (CVE-2026-70246) that allows an authenticated low-privilege attacker to gain elevated privileges. This could enable unauthorized access to sensitive collaboration content, data tampering, and service disruption. Leadership should prioritize patching to protect organizational data integrity and maintain user trust.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Sharepoint
View allRemote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authen
SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted
Authenticated code injection in Microsoft SharePoint (CVSS 3.1 base 8.8) allows a remote attacker holding a valid low-pr
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190)
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.2
Authenticated path traversal in Microsoft SharePoint Server can be escalated to code execution over the network, allowin
Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated remote attacker holding
Privilege elevation in Microsoft SharePoint Server Subscription Edition lets any attacker who already holds a valid low-
Privilege escalation in Microsoft SharePoint allows an authenticated low-privileged user to invoke functionality that la
Privilege escalation in Microsoft SharePoint allows an authenticated attacker with low-level privileges to gain elevated
Exploit-DB