EUVD-2026-100192
GHSA-5x5c-f4vh-96cj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged SharePoint account
-
DeliverySend crafted network request to server
-
ExploitAbuse improper privilege management (CWE-269)
-
ExecutionElevate to administrative/system privileges
-
ImpactFull compromise of SharePoint farm
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged authenticated account on the targeted SharePoint Server Subscription Edition farm (CVSS PR:L), reachable over the network (AV:N), with no user interaction needed (UI:N) and low attack complexity (AC:L). The limiting factor is the authentication prerequisite: this is not a pre-authentication flaw, so an attacker must first obtain or already possess SharePoint credentials. Affected deployments are Microsoft SharePoint Server Subscription Edition 16.0.0 prior to build 16.0.20326.20190; patched builds are not exploitable. No special non-default configuration is identified in the available data as a precondition. |
| Impact | This is a legitimately high-priority vulnerability but not an emergency. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity privilege-escalation flaw (CWE-269) requiring only low-level authenticated access and no user interaction, yielding total confidentiality, integrity, and availability impact on the SharePoint server. The SSVC framework aligns with a serious-but-contained picture: Technical Impact is 'total' (consistent with the C:H/I:H/A:H vector), but Exploitation is currently 'none' and Automatable is 'no' - meaning CISA sees no observed exploitation and does not consider it suited to mass/automated attack, consistent with a privilege-escalation bug that presupposes an existing foothold rather than a pre-auth internet worm. The vulnerability is NOT in CISA KEV and no public POC is referenced, so there is no evidence of active exploitation. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in and should be checked separately. Net: prioritize patching because SharePoint is a high-value collaboration platform where any authenticated user could become effectively server-admin, but there is no signal of in-the-wild abuse that would justify out-of-band emergency response over normal expedited patching. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged authenticated account on a SharePoint Server Subscription Edition farm (for example a standard site member, or an account obtained via phishing) sends crafted requests over the network to abuse improper privilege management, elevating to administrative or system-level rights on the server. No user interaction is required and attack complexity is low, but a valid low-privilege credential is a prerequisite. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a low-privileged account escalate to full control over the affected farm, with high impact to confidentiality, integrity, and availability (CVSS 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable over the network with low complexity and no user interaction, but it is not pre-authentication - an attacker must first obtain or already possess valid SharePoint credentials. Affected are deployments of SharePoint Server Subscription Edition 16.0.0 prior to build 16.0.20326.20190; patched builds are not exploitable. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none, and Microsoft has released a vendor fix, so this is a high-priority but not emergency patch.
RemediationAI
Vendor-released patch: apply the Microsoft update bringing SharePoint Server Subscription Edition to build 16.0.20326.20190 or later, following the guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96044; verify the installed build number after patching because the fix is build-gated rather than version-gated. Until patching completes, treat every low-privileged SharePoint account as a potential escalation path: reduce the number of interactive and service accounts that can authenticate to the farm, remove stale or shared credentials, and tighten site-collection and farm-level permission assignments so that a compromised account starts from the least privilege possible - the trade-off is added administrative overhead and possible disruption to legitimate workflows that relied on broad permissions. Because exploitation requires valid credentials rather than an anonymous foothold, network segmentation or blocking SharePoint endpoints offers only marginal protection against an insider or a phished account and should not be treated as a substitute for patching; its benefit is limiting lateral reach if the escalation is combined with other access. Increase audit and alerting on SharePoint privilege-change events and unusual elevated operations, though this is detective rather than preventive and depends on log retention and centralization. No public exploit code or active exploitation has been identified (SSVC exploitation: none), so remediation can follow a normal high-priority patch cycle rather than emergency change procedures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is classified as CWE-269 (Improper Privilege Management), meaning the affected SharePoint server-side component does not correctly constrain or validate the privilege level associated with a request, allowing an operation intended for a higher-privileged role to be performed by a lower-privileged authenticated user. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a remotely reachable, low-complexity attack that requires a low-privileged authenticated account (PR:L), needs no user interaction (UI:N), stays within a single security scope (S:U), and yields total impact across confidentiality, integrity, and availability. Because PR:L rather than PR:N is specified, the vulnerability is not exploitable by an unauthenticated visitor - the authentication prerequisite is the principal limiting factor, and the assessment found no special non-default configuration required as a precondition. The affected technology is the on-premises SharePoint Server Subscription Edition codebase (CPE family 16.0.0), with the ENISA EUVD entry (EUVD-2026-100192) identifying builds below 16.0.20326.20190 as vulnerable. The underlying NVD record carries no CWE assignment in its description text, so the CWE-269 classification here comes from the consolidated intelligence rather than from NVD's own tagging.
Know when Sharepoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable privilege escalation needing a low-privileged account (PR:L) and no interaction (UI:N); improper privilege management yields total host impact (C/I/A:H), scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
A privilege escalation vulnerability in Microsoft SharePoint Server Subscription Edition allows an authenticated user with a low-privileged account to gain full control of the affected farm, affecting confidentiality, integrity, and availability across the environment. This creates organizational risk because internal users, contractors, or compromised accounts could escalate privileges and access, alter, or disrupt sensitive content and collaboration services. No public exploit code has been identified at time of analysis, but a vendor patch is available and remediation should be prioritized for business-critical SharePoint deployments.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Sharepoint
View allRemote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authen
SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted
Authenticated code injection in Microsoft SharePoint (CVSS 3.1 base 8.8) allows a remote attacker holding a valid low-pr
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190)
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.2
Authenticated path traversal in Microsoft SharePoint Server can be escalated to code execution over the network, allowin
Privilege escalation in Microsoft SharePoint Server Subscription Edition before build 16.0.20326.20190 allows a remote l
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated remote attacker holding
Privilege elevation in Microsoft SharePoint Server Subscription Edition lets any attacker who already holds a valid low-
Privilege escalation in Microsoft SharePoint allows an authenticated low-privileged user to invoke functionality that la
Privilege escalation in Microsoft SharePoint allows an authenticated attacker with low-level privileges to gain elevated
Exploit-DB