EUVD-2026-99708
GHSA-w9hc-c5q9-3pxg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege SharePoint user
-
DeliverySubmit crafted SSRF request to server
-
ExploitServer issues attacker-controlled internal request
-
ExecutionReach privileged internal endpoint
-
ImpactElevate privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account on the affected SharePoint deployment (CVSS PR:L - low-privilege but non-anonymous), so it is not reachable by fully unauthenticated attackers. The affected scope is Microsoft SharePoint Server Subscription Edition builds 16.0.0 below 16.0.20326.20190; patched builds are not exploitable. The CVSS AC:H indicates additional server-side conditions, timing, or specific configuration must be met for the SSRF to succeed, which materially limits reliability. No user interaction is required (UI:N). |
| Impact | This is a genuine but moderate-priority issue rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N) describes a network-reachable but authenticated (PR:L) flaw with HIGH attack complexity, meaning exploitation depends on conditions the attacker cannot fully control. Multiple signals agree on a lower real-world urgency: EPSS data was NOT provided in the input (cannot cite a probability), CISA KEV status is absent, no POC is referenced, and the SSVC decision framework explicitly rates Exploitation as 'none' and Automatable as 'no'. The one signal pulling the other way is SSVC Technical Impact = 'total', which is consistent with the C:H/I:H/A:H impact metrics and the stated privilege-elevation outcome. In short: high potential impact if exploited, but low current exploitation likelihood and non-trivial preconditions (authentication + high complexity). Note a mild framing tension - the CWE is SSRF (CWE-918), which typically yields confidentiality/pivot impact, yet the description frames the outcome as privilege elevation; the combined C:H/I:H/A:H + 'total' impact is plausible if the SSRF reaches privileged internal SharePoint/back-end services, but the exact mechanism is not detailed in the available data and should be confirmed via the Microsoft MSRC advisory. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege authenticated account on a SharePoint Server Subscription Edition site submits a crafted request that coerces the server into making an attacker-influenced server-side HTTP request to an internal/privileged endpoint, allowing them to elevate privileges. Because the CVSS vector marks AC:H, success depends on specific server-side conditions or timing rather than a trivially repeatable request. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Server-side request forgery in Microsoft SharePoint Server Subscription Edition (on-premises builds 16.0.0 below 16.0.20326.20190) lets an authenticated, low-privilege user coerce the SharePoint server into issuing HTTP requests to internal or otherwise unreachable endpoints, producing high confidentiality, integrity and availability impact and enabling privilege elevation over the network. The issue is rated CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), so an existing authenticated account is required and additional server-side conditions must be satisfied for the forgery to succeed, which materially limits reliability. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none', and Microsoft has published a vendor-released fix, making this a genuine but moderate-priority issue rather than a drop-everything emergency.
RemediationAI
Apply the vendor fix: update Microsoft SharePoint Server Subscription Edition to build 16.0.20326.20190 or later (the fixed baseline in the EUVD version range, distributed through Microsoft's subscription-edition security update channel), following the instructions in the Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70251; this is the primary and complete remediation. Because the vulnerable behavior is an outbound server-initiated request, the highest-value compensating control if patching must be staged is egress filtering on the SharePoint web front ends - deny outbound HTTP/HTTPS to loopback, link-local and cloud metadata addresses (for example 169.254.169.254) and allow only the specific external endpoints the farm legitimately needs; the trade-off is that overly tight rules will break web parts, feeds, Business Connectivity Services, workflows, hybrid search and Office Online integration, so profile legitimate outbound traffic first and expect tuning effort. Also restrict the service and farm accounts to least privilege and reduce the number of users holding site-owner, contribute or app-registration rights, since the attack requires an authenticated low-privilege account and cutting that population reduces exposure - the trade-off being curtailed collaboration features and possible helpdesk load. Detection-side, alert on anomalous outbound requests originating from SharePoint processes to internal subnets or metadata IPs, which can catch attempts that the patch has not yet closed. Patch status is 'Vendor-released patch'; do not rely on configuration hardening alone as a substitute for installing the fixed build.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The bug is classified CWE-918 (Server-Side Request Forgery), a root-cause class in which an application accepts attacker-influenced input that determines the destination of a server-initiated request. SharePoint's front-end performs server-side fetches on behalf of users - for features such as web parts, feeds, connectors, business data and hybrid/Office Online integration - and the affected code fails to adequately validate or restrict the target of those requests. That allows a low-privileged account (PR:L, so authenticated but non-anonymous) to point the request at internal hosts, loopback services, or cloud metadata endpoints reachable from the SharePoint web front end, bypassing the network perimeter and any client-side controls. The vector rates attack complexity High (AC:H), indicating that server-side prerequisites, specific configuration, or timing must line up for exploitation, and scope is Unchanged (S:U), meaning the impact lands on the SharePoint server and the resources it can already reach rather than crossing an authorisation boundary into a wholly separate security authority. No user interaction is involved (UI:N) and the impact triad is High across confidentiality, integrity and availability. The technology is the subscription-based on-premises SharePoint Server line, which is serviced by Microsoft's standard subscription-edition update channel and monthly security updates; the affected and fixed builds come from EUVD (EUVD-2026-99708), and the authoritative advisory is the Microsoft Security Response Center update guide entry for CVE-2026-70251.
Know when Sharepoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable (AV:N) but requires a low-privilege account (PR:L) and specific server-side conditions (AC:H); SSRF reaching privileged services justifies C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
Microsoft SharePoint Server Subscription Edition (on-premises) carries a server-side request forgery weakness that an ordinary authenticated user account could use to make the server itself reach internal systems normally closed off from that user, creating risk of sensitive data exposure and privilege escalation inside the network. Exploitation requires valid credentials and specific server-side conditions, and no public exploit code or active exploitation has been observed, so this is a moderate-priority exposure rather than an emergency. Leadership should care because affected on-premises deployments sit close to internal services, meaning a single compromised or malicious user account could amplify access beyond its intended boundaries.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
More in Sharepoint
View allRemote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authen
SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted
Authenticated code injection in Microsoft SharePoint (CVSS 3.1 base 8.8) allows a remote attacker holding a valid low-pr
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190)
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.2
Authenticated path traversal in Microsoft SharePoint Server can be escalated to code execution over the network, allowin
Privilege escalation in Microsoft SharePoint Server Subscription Edition before build 16.0.20326.20190 allows a remote l
Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated remote attacker holding
Privilege elevation in Microsoft SharePoint Server Subscription Edition lets any attacker who already holds a valid low-
Privilege escalation in Microsoft SharePoint allows an authenticated low-privileged user to invoke functionality that la
Exploit-DB