EUVD-2026-99714
GHSA-9mvx-2hw3-3g98
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege SharePoint account
-
DeliverySubmit crafted input to vulnerable parameter
-
ExploitInject malicious SQL command
-
ExecutionManipulate content database queries
-
ImpactElevate privileges and compromise data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires valid authenticated access to the SharePoint Server (CVSS PR:L), so the attacker must already possess at least a low-privilege account on the target instance - this is the primary limiting factor and rules out anonymous internet exploitation. The affected configuration is SharePoint Server Subscription Edition build 16.0.0 prior to 16.0.20326.20190; environments at or above that patched build are not vulnerable. No user interaction is required (UI:N) and the attack is over the network against the application. The input does not name the exact vulnerable feature, parameter, or endpoint carrying the SQL injection, so defenders cannot scope to a specific configuration setting beyond 'authenticated access to the SharePoint web application.' |
| Impact | This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity SQL injection in Microsoft SharePoint Server that an authenticated (PR:L) attacker can leverage for full confidentiality, integrity, and availability impact (C:H/I:H/A:H), yielding the 8.8 base score. The signals are internally consistent but point toward a lower real-world urgency than the raw score suggests: CISA's SSVC framework records Exploitation as 'none' and Automatable as 'no' (while Technical Impact is 'total'), the vulnerability is NOT in CISA KEV, and no public exploit code is referenced. No EPSS score was provided in the input, so the statistical exploitation-probability signal is MISSING and cannot be weighed. The requirement for valid authenticated access (PR:L) is the key mitigating factor that separates this from a wormable unauthenticated RCE. Net: a real, patch-worthy privilege-escalation/data-compromise bug on a high-value enterprise platform, but at time of analysis there is no evidence of active or automatable exploitation - prioritize patching alongside other authenticated SharePoint flaws rather than as a zero-day fire drill. |
| Exploit ScenarioDerived | An attacker who already holds low-privilege authenticated access to a SharePoint Server (e.g., a standard site user or a compromised low-tier account) submits crafted input into a field or request parameter that is passed unsanitized into a backend SQL command. By injecting SQL syntax, the attacker reads or modifies content database data and escalates privileges across the SharePoint environment over the network. No public exploit identified at time of analysis, and SSVC rates the attack as not automatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted input that is incorporated into a SQL command, giving the attacker arbitrary control over the back-end database and effectively elevating their privileges on the farm. Only SharePoint Server Subscription Edition builds below 16.0.20326.20190 are affected, the attack requires a valid account on the target instance (CVSS PR:L) and no user interaction, so anonymous internet exploitation is not possible; environments already at or above the patched build are not exposed. Microsoft has shipped a fix and no public exploit code has been identified at time of analysis, with CISA SSVC recording Exploitation as none and Automatable as no, making this a credible but not emergency-tier priority that should be fixed on a normal patch cycle - the high CVSS score of 8.8 reflects total loss of confidentiality, integrity and availability once the injection is successfully driven.
RemediationAI
Vendor-released patch: apply the Microsoft security update that brings SharePoint Server Subscription Edition to build 16.0.20326.20190 or later, as indicated by the EUVD affected-version range ending at that build; follow the MSRC Update Guide entry at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70266 for the exact package and deployment sequence, and note that SharePoint updates generally require running the binary update plus the SharePoint Products Configuration Wizard on every farm server, with an IIS reset and a possible service interruption. Patch availability is confirmed by the vendor, so no durable mitigation is required once the build is current; interim compensating controls carry real trade-offs and should be treated as temporary. Because exploitation requires a valid authenticated account (PR:L), the highest-value short-term control is reducing the number of principals who can reach the SharePoint web application - audit site collections, disable or remove stale, guest and unused accounts, tighten external sharing and anonymous-access settings, and enforce MFA, accepting that legitimate business users may lose access until accounts are re-provisioned. If a web application firewall or reverse proxy fronts the farm, enable SQL-injection signature rules on requests to SharePoint endpoints and alert on T-SQL metacharacters and UNION/stacked-query patterns; this may generate false positives against legitimate search and filter query strings and is not a substitute for patching. On the database tier, keep the SharePoint content-database connection running under the least-privileged app-pool account already in use and enable SQL Server auditing or extended events so anomalous query text can be investigated, understanding that verbose database auditing increases log volume and can degrade performance on busy farms. Finally, since the advisory does not identify the vulnerable feature or parameter, defenders cannot narrow protection to a single endpoint or configuration switch and should prioritize inventorying farm build numbers and applying the update broadly; no public exploit code has been identified at time of analysis, so there is no urgent need for emergency out-of-band change control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89, improper neutralization of special elements used in a SQL command, commonly called SQL injection. SharePoint is an ASP.NET web application that persists nearly all of its content, configuration and permission metadata in a Microsoft SQL Server database, and any code path that builds T-SQL by concatenating user-supplied strings instead of using parameterized commands allows an attacker to inject additional SQL syntax. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a remotely reachable, low-complexity flaw that requires a pre-existing low-privilege authenticated session (PR:L) and no victim interaction (UI:N). Scope is Unchanged (S:U), which indicates the impact stays inside the SharePoint application's own security authority - typically read/write access to SharePoint content databases under the app-pool/service account rather than operating-system or cross-authority compromise - while the three High sub-scores reflect complete loss of confidentiality, integrity and availability of the affected data. The advisory does not disclose which SharePoint feature, page or parameter carries the vulnerable query, so the injection point cannot be pinned to a specific endpoint; the EUVD affected-version string identifies the vulnerable baseline as Microsoft SharePoint Server Subscription Edition 16.0.0 below 16.0.20326.20190, and the vulnerability is credited to Microsoft's own security team (secure@microsoft.com). This record is also tracked by ENISA as EUVD-2026-99714.
Know when Sharepoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable authenticated SQL injection (PR:L for the required low-privilege account, AC:L, no UI) against the backend database yields full C/I/A impact within an unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
Microsoft SharePoint Server Subscription Edition deployments running builds below 16.0.20326.20190 are exposed to a high-severity flaw that could allow a legitimate but low-privilege user to gain control of the platform's back-end database and elevate rights across the farm. This creates a material risk of unauthorized access to, alteration of, or loss of business content handled in SharePoint, though exploitation requires an existing account and no public exploit has been identified at time of analysis. Leadership should direct remediation on a normal patch cycle, prioritizing farms that hold sensitive data or support large user populations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Sharepoint
View allRemote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authen
Authenticated code injection in Microsoft SharePoint (CVSS 3.1 base 8.8) allows a remote attacker holding a valid low-pr
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190)
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.2
Authenticated path traversal in Microsoft SharePoint Server can be escalated to code execution over the network, allowin
Privilege escalation in Microsoft SharePoint Server Subscription Edition before build 16.0.20326.20190 allows a remote l
Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated remote attacker holding
Privilege elevation in Microsoft SharePoint Server Subscription Edition lets any attacker who already holds a valid low-
Privilege escalation in Microsoft SharePoint allows an authenticated low-privileged user to invoke functionality that la
Privilege escalation in Microsoft SharePoint allows an authenticated attacker with low-level privileges to gain elevated
Exploit-DB