What is the CVSS score of CVE-2026-70332?

CVE-2026-70332 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Microsoft SharePoint are affected by CVE-2026-70332?

Microsoft Office SharePoint is vulnerable to a critical server-side request forgery (CVE-2026-70332, CVSS 9.6) that allows remote unauthenticated attackers to spoof requests through the affected…

How to fix or mitigate CVE-2026-70332?

Within 24 hours: Identify and inventory all SharePoint instances in production, assess exposure of internet-facing or untrusted-network-accessible deployments, implement network segmentation to prevent outbound requests from SharePoint servers to internal resources, and enable detailed logging of all SharePoint outbound network activity. Within 7 days: Restrict SharePoint service account privileges to least-privilege minimum, deploy proxy and firewall rules blocking potentially dangerous outbound protocols, and disable unnecessary URL schemes that could be abused for SSRF attacks. Within 30 days: Monitor Microsoft security advisories continuously for patch availability, develop and test an emergency patching procedure for rapid deployment upon release, conduct a risk assessment to determine if temporary access restrictions or service suspension is necessary if adequate mitigations cannot be sustained, and prepare a contingency upgrade or migration strategy.

Microsoft SharePoint CVE-2026-70332

EUVD-2026-54327 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-07 secure@microsoft.com

GHSA-6599-vjfw-x4gh

SSRF Microsoft Sharepoint Online

9.6

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

vuln.today AI

8.2 HIGH

Unauthenticated network SSRF needing victim interaction (UI:R) with scope change (S:C); SSRF primarily yields confidentiality/internal-access (C:H) with limited integrity spoofing (I:L) and no direct availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 00:37 vuln.today

CVE Published

Aug 07, 2026 - 00:16 nvd

CRITICAL 9.6

DescriptionCVE.org

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

AnalysisAI

Server-side request forgery in Microsoft Office SharePoint lets a remote, unauthenticated attacker coerce the server into issuing attacker-controlled requests, enabling spoofing across a network per Microsoft's classification. The CVSS 3.1 base score is 9.6 (critical) with a changed scope, and exploitation requires a victim to interact with attacker-supplied content (UI:R). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The flaw is a classic CWE-918 Server-Side Request Forgery in SharePoint, Microsoft's on-premises and Online collaboration/document-management platform built on ASP.NET and IIS. SSRF arises when server-side code fetches a URL or resource whose destination is influenced by untrusted input without adequate validation of the target host, scheme, or address range. In SharePoint this typically involves features that retrieve remote content (previews, connectors, webhooks, or import/rendering functions); an attacker abuses this to make the SharePoint server originate requests to internal or otherwise unreachable services, which is why the CVSS scope is marked Changed (S:C) - the vulnerable component causes impact to resources beyond its own security scope.

RemediationAI

Apply the Microsoft security update for CVE-2026-70332 as published in the MSRC Security Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70332); the exact fixed build numbers are enumerated there and should be applied to all affected SharePoint servers - Patch available per vendor advisory (no exact fix version was included in the provided data). As compensating controls until patching, restrict the SharePoint server's outbound network egress with a firewall/proxy allowlist so it cannot reach internal metadata endpoints or unrelated internal services (trade-off: may break legitimate outbound connectors, previews, or federation), place SharePoint behind a reverse proxy/WAF that inspects and filters server-initiated request patterns, and limit exposure of content-fetching features to trusted users where configurable. Because exploitation requires user interaction, reinforce user awareness against opening untrusted SharePoint content/links.