EUVD-2026-54327
GHSA-6599-vjfw-x4gh
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Unauthenticated network SSRF needing victim interaction (UI:R) with scope change (S:C); SSRF primarily yields confidentiality/internal-access (C:H) with limited integrity spoofing (I:L) and no direct availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
Server-side request forgery in Microsoft Office SharePoint lets a remote, unauthenticated attacker coerce the server into issuing attacker-controlled requests, enabling spoofing across a network per Microsoft's classification. The CVSS 3.1 base score is 9.6 (critical) with a changed scope, and exploitation requires a victim to interact with attacker-supplied content (UI:R). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires user interaction (CVSS UI:R): a victim must open or interact with attacker-supplied content processed by the SharePoint server, so this is not a fully autonomous drive-by. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) signals a network-reachable, low-complexity, unauthenticated issue whose only meaningful barrier is required user interaction, and whose scope change drives the critical score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious SharePoint document, link, or content item and lures an authenticated victim into interacting with it (UI:R); when opened, the SharePoint server is coerced into sending an attacker-controlled request to an internal endpoint. Because scope is changed (S:C), the forged request reaches internal services the attacker could not otherwise access - for example enumerating internal hosts, hitting cloud/instance metadata, or spoofing a trusted internal identity. … |
| Remediation | Apply the Microsoft security update for CVE-2026-70332 as published in the MSRC Security Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70332); the exact fixed build numbers are enumerated there and should be applied to all affected SharePoint servers - Patch available per vendor advisory (no exact fix version was included in the provided data). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all SharePoint instances in production, assess exposure of internet-facing or untrusted-network-accessible deployments, implement network segmentation to prevent outbound requests from SharePoint servers to internal resources, and enable detailed logging of all SharePoint outbound network activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Sharepoint Online
View allSame weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today