EUVD-2026-100180
GHSA-3jjh-hxw6-pghf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege SharePoint user
-
DeliverySend crafted network request
-
ExploitTrigger privilege context switching error (CWE-270)
-
ExecutionExecute actions with elevated privileges
-
ImpactFull compromise of SharePoint data and configuration
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Privilege context switching
|
| Exploitation Conditions | Requires a valid authenticated account on Microsoft SharePoint Server Subscription Edition (CVSS PR:L), with the account having at least low-privilege network access to the SharePoint application; no user interaction is required (UI:N) and attack complexity is low (AC:L). Exploitation is limited to versions below 16.0.20326.20190 (16.0.0 branch) and is blocked once the vendor patch is applied. The principal limiting factor is the authentication requirement - fully unauthenticated external attackers cannot trigger it directly - and CISA SSVC assesses it as not automatable, reducing the likelihood of mass/scripted exploitation. |
| Impact | Signals are moderately concerning but not emergency-tier. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-reachable, low-complexity elevation of privilege by an already-authenticated low-privilege user, yielding high confidentiality, integrity, and availability impact - consistent with CISA SSVC's 'Technical Impact: total'. However, SSVC also reports 'Exploitation: none' and 'Automatable: no', and there is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed to be under active attack. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in - this is a data gap. The net picture is a genuinely high-impact SharePoint EoP that is credible and patch-worthy for any exposed/multi-tenant SharePoint estate, but the absence of active exploitation, non-automatable nature, and required authentication place it below drop-everything priority. Note a tag inconsistency: the input is tagged 'Information Disclosure', yet the description and CWE-270 (privilege context switching) describe an elevation-of-privilege flaw - treat the tag as unreliable, not the described impact. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege authenticated account on a SharePoint Server Subscription Edition instance (e.g., a standard user or a foothold obtained via phishing) sends crafted requests over the network that exploit the privilege context switching error, causing the server to act with elevated privileges. With AC:L and UI:N, the operation is low-complexity and needs no victim interaction. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated remote attacker holding only low-privilege credentials to elevate privileges over the network without any user interaction. The flaw is a privilege context switching error (CWE-270) affecting 16.0.0 builds below 16.0.20326.20190, and a vendor patch is available through the Microsoft Security Response Center. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable, so while technical impact is total, the practical risk is elevated rather than emergency-tier.
RemediationAI
Apply the Microsoft security update for SharePoint Server Subscription Edition to build 16.0.20326.20190 or later; the fix is available from the vendor and detailed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88200. Because the attack requires a valid authenticated SharePoint account (CVSS PR:L) and no further interaction, prioritize patching internet-facing or partner-accessible SharePoint farms first, and verify the applied build number on each farm. If immediate patching is not possible, compensating controls should focus on the authentication prerequisite: restrict and audit SharePoint accounts that are permitted to authenticate to the farm (for example, removing dormant or broad guest accounts and reviewing external sharing), which reduces the pool of usable low-privilege footholds at the cost of some collaboration flexibility; additionally, segment the farm behind network controls or a reverse proxy so only intended user populations can reach it, and alert on anomalous elevation, permission-change, or site-collection-administration activity in SharePoint audit logs, accepting that logging-based detection is detective rather than preventive. Avoid relying solely on workarounds, since the SSVC technical impact is rated total and the vendor patch is the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-270, Privilege Context Switching Error: the application fails to correctly manage the security context when it temporarily operates under elevated or impersonated privileges, so a request originating from a low-privileged authenticated user can be processed with rights it should not have. In SharePoint Server, this class of bug typically appears in code paths that use impersonation or elevated execution contexts (for example, elevated-privilege calls, token switching within web requests, or timer/service-side operations) and either fail to revert the context or fail to validate that the caller is entitled to the elevated context. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity attack that requires a valid low-privileged account and no user interaction, producing high confidentiality, integrity, and availability impact within the SharePoint security authority (scope unchanged). Reported by Microsoft (secure@microsoft.com), it is tracked by ENISA as EUVD-2026-100180 and is distinct from the disclosure-type tag applied to some SharePoint issues, because the assessed impact is full privilege escalation rather than information exposure alone.
Know when Sharepoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable (AV:N) low-complexity (AC:L) EoP requiring an existing low-privilege authenticated account (PR:L), no user interaction (UI:N), total technical impact per SSVC yields C/I/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
Microsoft SharePoint Server Subscription Edition contains a high-severity privilege escalation vulnerability (CVE-2026-88200) that allows an attacker to gain elevated access across the network without user interaction. This could enable unauthorized data access, site manipulation, or lateral movement, impacting confidentiality, integrity, and availability of critical business information. Leadership should prioritize patching because SharePoint often hosts sensitive organizational data and the flaw has a total technical impact, though no public exploit is currently identified.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Sharepoint
View allRemote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authen
SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted
Authenticated code injection in Microsoft SharePoint (CVSS 3.1 base 8.8) allows a remote attacker holding a valid low-pr
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190)
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.2
Authenticated path traversal in Microsoft SharePoint Server can be escalated to code execution over the network, allowin
Privilege escalation in Microsoft SharePoint Server Subscription Edition before build 16.0.20326.20190 allows a remote l
Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a
Privilege elevation in Microsoft SharePoint Server Subscription Edition lets any attacker who already holds a valid low-
Privilege escalation in Microsoft SharePoint allows an authenticated low-privileged user to invoke functionality that la
Privilege escalation in Microsoft SharePoint allows an authenticated attacker with low-level privileges to gain elevated
Exploit-DB