Microsoft SharePoint CVE-2026-85932

Exploitation requires the attacker to possess valid authenticated access to the target SharePoint Server (CVSS PR:L), limiting it to insiders or attackers with stolen/low-privilege credentials rather than anonymous internet attackers. No user interaction is required (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L). The specific vulnerable component is a pathname-handling routine in Microsoft Office SharePoint that fails to properly restrict traversal outside its intended directory (CWE-22). Affected scope is narrow: only SharePoint Server Subscription Edition 16.0.0 prior to build 16.0.20326.20190; patched builds and other editions are not implicated by the provided data. Impact is limited to information disclosure (C:H, I:N, A:N) - the flaw cannot be used to alter content or cause denial of service.

This is a moderate-severity information disclosure flaw (CVSS 6.5) with multiple signals converging on LOW real-world urgency rather than emergency priority. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-reachable, low-complexity exploitation but requires an authenticated attacker (PR:L), which meaningfully raises the bar since SharePoint deployments typically authenticate users. CISA's SSVC framework reinforces low urgency: Exploitation=none (no observed or expected exploitation), Automatable=no (cannot be reliably scripted at scale, consistent with the per-target authentication requirement), and Technical Impact=partial (bounded disclosure, not full compromise). No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public POC is indicated, so there is no public exploit identified at time of analysis. The signals are mutually consistent - there is no conflict between the CVSS vector, SSVC, and the CWE-22 path-traversal description, all of which point to an authenticated read-only disclosure. Net assessment: a legitimate issue worth patching on a normal cycle given SharePoint's sensitivity as a document repository, but not a high-real-risk, drop-everything emergency.

An attacker who already holds valid (low-privilege) credentials to a SharePoint Server site crafts a request containing traversal sequences in a pathname parameter to escape the intended restricted directory and read files outside it over the network. No public exploit code was identified at time of analysis, and because the impact is confidentiality-only (I:N/A:N), the attacker can disclose information but not modify data or disrupt availability.