EUVD-2026-100163
GHSA-fm2j-rw66-4jvq
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a moderate-priority vulnerability that does not currently rise to emergency status. The CVSS 3.1 base score of 7.5 reflects a network attack vector (AV:N) with total technical impact (C:H/I:H/A:H), but two metrics meaningfully constrain real-world risk: high attack complexity (AC:H) and a requirement for low-level privileges (PR:L), meaning the attacker must already be an authenticated/authorized SharePoint user. These signals align with the CISA SSVC decision framework, which records Exploitation: none, Automatable: no, and Technical Impact: total - i.e., severe if achieved but neither currently exploited nor easily scriptable at scale. There is no CISA KEV listing and no public exploit identified, so this is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so exploitation-probability cannot be quantified here. The combination of high complexity, required authentication, and 'Automatable: no' suggests that even if exploited this would be targeted rather than mass/wormable, consistent with the SSRF-to-privilege-escalation pattern. Net: patch on a normal prioritized cycle (elevated because it is internet-reachable enterprise collaboration software), but this is not a drop-everything high-real-risk issue in the absence of exploitation signals. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Server-side request forgery in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker with low privileges force the SharePoint application server to issue crafted requests on their behalf, which can expose sensitive internal resources and, per Microsoft's rating, enable privilege elevation over a network. The affected builds are SharePoint Server Subscription Edition versions earlier than 16.0.20326.20190, and exploitation requires network access plus a valid low-privileged account while also requiring attack-specific conditions that Microsoft captures as high complexity (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5). CISA's SSVC decision data records Exploitation: none, Automatable: no, and Technical Impact: total, so no public exploit code or in-the-wild activity is identified; the impact is nonetheless potentially total against confidentiality, integrity, and availability once the request-forgery primitive is chained successfully, and a vendor patch is available. This is a moderate-priority vulnerability that does not currently rise to emergency status.
RemediationAI
Patch available per vendor advisory: Microsoft has published a fix through the Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70202, and since the affected range is defined as SharePoint Server Subscription Edition builds earlier than 16.0.20326.20190, updating the farm to that build or a later cumulative update is the remediation path. Apply the update to every server in the farm in the supported order (run the binary update on each server, then run the SharePoint Products Configuration Wizard) and verify the resulting build in Central Administration, because SSRF fixes are implemented in the web front-end request pipeline and a partially patched farm can leave mixed behavior. If patching must be deferred, compensating controls are specific rather than generic: enforce egress filtering on SharePoint servers so they cannot initiate outbound connections to internal RFC1918 ranges, loopback addresses, or the cloud instance metadata endpoint 169.254.169.254, which directly removes the SSRF pivot while requiring an accurate allow-list of legitimate external content sources the farm depends on; restrict and audit which accounts hold the low-privileged access needed as a precondition, since PR:L means unauthenticated visitors alone cannot exploit this; and disable or tightly scope unused SharePoint features that fetch remote URLs, such as Business Data Connectivity and web parts that render external content, accepting that this breaks those business scenarios. Monitor SharePoint ULS and IIS logs for anomalous outbound requests from web front-end processes as a detection measure while patches roll out. Note that a public proof-of-concept exploit has not been identified, and CISA SSVC records Exploitation: none, so urgency is driven by the total potential technical impact rather than observed attacks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-918, server-side request forgery, a class of flaw in which an application accepts a user-controllable URL or endpoint reference and dereferences it server-side without validating the destination against an allow-list. In SharePoint, web front-end processes routinely fetch remote resources on behalf of users - for example rendering remote images and web-part content, resolving external data sources, or retrieving content from other sites - and an attacker who can influence those parameters makes the SharePoint server act as a proxy. Because the request originates from the trusted SharePoint host, it can reach internal-only services, management endpoints, and cloud metadata services that are normally unreachable from the internet, which is why the assessed confidentiality and integrity impacts are High rather than the more typical SSRF profile of read-only leakage. The CVSS vector shows PR:L, so an authenticated low-privileged identity is required, and AC:H, meaning the attacker must satisfy additional preconditions such as a reachable vulnerable endpoint and correct target addressing. Scope is unchanged (S:U), so impact stays within the SharePoint security authority, and no user interaction is needed (UI:N). The implicated product family is Microsoft SharePoint Server Subscription Edition, the subscription-based perpetual servicing line; the enumerated affected build range is 16.0.0 through builds earlier than 16.0.20326.20190. Microsoft rates this with a total technical impact per the SSVC input, consistent with an SSRF that can pivot into privilege elevation rather than a simple information disclosure.
Know when Sharepoint Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
Microsoft SharePoint Server Subscription Edition is affected by a high-severity server-side request forgery flaw that an authenticated low-privileged user could leverage to make the application server issue crafted requests, potentially exposing sensitive internal resources and enabling network privilege elevation. This matters because SharePoint is a central collaboration platform that may hold or broker access to business-critical data and internal services, so a successful chained attack could affect confidentiality, integrity, and availability. Vendor-released patch: 16.0.20326.20190 is available, and no public exploit identified at time of analysis, so remediation should be prioritized but can follow risk-based scheduling for non-exposed farms.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Code injection (CWE-94) in Microsoft SharePoint Server exposes authenticated network users to high-impact compromise acr
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Exploit-DB