EUVD-2026-100179
GHSA-94rr-7cq4-rj7c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege SharePoint account
-
DeliverySend crafted network request to server
-
ExploitTrigger integer wraparound and stack overflow
-
ExecutionExecute arbitrary code on server
-
ImpactCompromise SharePoint host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires valid authenticated access to the SharePoint server at a low privilege level (PR:L), meaning the attacker must possess credentials for a SharePoint account before sending the malicious network request; no user interaction by a victim is needed. The affected configuration is specifically Microsoft SharePoint Server Subscription Edition builds below 16.0.20326.20190. The authentication requirement is the primary limiting factor - unauthenticated attackers cannot reach the vulnerable code path - but internet-facing SharePoint portals with self-service or broadly provisioned accounts substantially lower this barrier. |
| Impact | This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes network-exploitable remote code execution requiring only low-level privileges, no user interaction, and low attack complexity, with full compromise of confidentiality, integrity, and availability. Authentication is required (PR:L), which modestly limits exposure, but SharePoint deployments typically grant authenticated access to large user populations, so the authenticated barrier is weak in practice. No EPSS score, KEV listing, or POC indicator is present in the supplied data, so current exploitation is not confirmed - this must not be treated as actively exploited. Note a data inconsistency to verify with the vendor: the description states 'integer overflow or wraparound' while CWE-121 and the tags ('Buffer Overflow', 'Stack Overflow') point to a stack-based buffer overflow - these are consistent only if an integer wraparound leads to an undersized buffer allocation that is then overflowed. SharePoint RCE flaws have historically become attacker targets quickly once patches reverse-engineered, so prompt patching is warranted despite the absence of current exploitation signals. |
| Exploit ScenarioDerived | An attacker with valid low-privilege SharePoint credentials (e.g., an authenticated site member) sends a crafted request to a vulnerable SharePoint Server Subscription Edition instance that triggers the integer wraparound and resulting stack buffer overflow, achieving arbitrary code execution in the server process context. Because no user interaction is required and attack complexity is low, a single malicious request suffices. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) allows a low-privileged SharePoint user to run arbitrary code on the server over the network. Per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8), the attacker must already hold valid credentials for a SharePoint account - the vulnerable code path is not reachable by unauthenticated users - but no victim interaction is required, and the impact on confidentiality, integrity, and availability is total. The status of this vulnerability at the time of analysis is that no public exploit code has been identified; it is not listed in CISA KEV, so confirmed in-the-wild exploitation has not been established, though the low attack complexity and the common exposure of internet-facing SharePoint portals with broadly provisioned accounts make it a high-priority patch target.
RemediationAI
Vendor-released patch: Microsoft published a fix for this issue (patch status: available from vendor; reported by secure@microsoft.com), and administrators should update SharePoint Server Subscription Edition to build 16.0.20326.20190 or later via the Microsoft Security Response Center update guide for CVE-2026-88166 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88166); follow Microsoft's normal SharePoint patching sequence (install the update on each server in the farm, then run the SharePoint Products Configuration Wizard) and plan for service interruption during the configuration pass. Because exploitation requires valid authenticated access at low privilege (PR:L) and no user interaction, the most effective compensating controls reduce the attacker's ability to obtain or use an account: enforce MFA and strong credential hygiene across all SharePoint accounts, aggressively prune stale, guest, and self-service-provisioned accounts, and audit site-collection permissions so that ordinary users hold only the rights they need - the trade-off is administrative overhead and potential disruption to legitimate collaborators. Where SharePoint is internet-facing and cannot be patched immediately, restrict the attack surface by placing the farm behind a reverse proxy or VPN that permits only known corporate identities, blocking or rate-limiting unusual authenticated POST traffic to SharePoint endpoints, and enabling verbose request logging and file-integrity or process-creation monitoring on the web front ends to catch post-exploitation behavior; each of these narrows legitimate access and increases false positives, so treat them as temporary measures until the update is applied. Note that no public exploit code has been identified at the time of this analysis, and the vulnerability is not confirmed as actively exploited, so remediation can proceed on a risk-prioritized rather than emergency basis - but with a 8.8 score and low attack complexity, the window should be short.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a memory-safety defect reached through the SharePoint web request pipeline, where an integer overflow or wraparound in the handling of a network-supplied value corrupts length/offset arithmetic and ultimately writes beyond the bounds of a stack buffer - Microsoft's own classification maps this record to CWE-121 (stack-based buffer overflow), while the description frames the root cause as an integer overflow/wraparound (CWE-190 pattern); the two are consistent as a chain, with the arithmetic error enabling the stack overflow. The affected component runs inside the web front end of Microsoft SharePoint Server Subscription Edition (the perpetual, subscription-licensed SharePoint release), which runs on Windows/IIS and processes requests from authenticated users; because the code path is gated behind SharePoint authentication (CVSS PR:L), the attacker must first obtain any valid low-privilege SharePoint account, after which standard HTTP requests are sufficient to trigger the overflow. The relevant product identity is Microsoft SharePoint Server Subscription Edition with a build number below 16.0.20326.20190; no CPE string was supplied in the source data, so the version range from the EUVD record (EUVD-2026-100179) is the authoritative indicator of exposure. Successful exploitation yields remote code execution in the SharePoint process context, giving an attacker the same server-side privileges as the web application, which typically permits data exfiltration across site collections and further lateral movement within the SharePoint farm.
Know when Sharepoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable (AV:N) with low complexity (AC:L); an authenticated SharePoint account is required so PR:L, no victim interaction (UI:N), and RCE yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Executive ViewAI
Microsoft SharePoint Server Subscription Edition contains a high-severity flaw that lets any user with a standard SharePoint account execute arbitrary code on the server over the network, with full impact to data confidentiality, integrity, and availability. Because SharePoint portals are frequently internet-facing and accounts are broadly provisioned to staff, contractors, and partners, the pool of potential attackers is effectively anyone holding legitimate credentials - including a compromised or malicious insider account. Leadership should treat remediation as urgent: a single low-privilege account is sufficient to take control of a system that typically hosts sensitive corporate documents and business workflows.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
More in Sharepoint
View allRemote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authen
SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted
Authenticated code injection in Microsoft SharePoint (CVSS 3.1 base 8.8) allows a remote attacker holding a valid low-pr
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.2
Authenticated path traversal in Microsoft SharePoint Server can be escalated to code execution over the network, allowin
Privilege escalation in Microsoft SharePoint Server Subscription Edition before build 16.0.20326.20190 allows a remote l
Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated remote attacker holding
Privilege elevation in Microsoft SharePoint Server Subscription Edition lets any attacker who already holds a valid low-
Privilege escalation in Microsoft SharePoint allows an authenticated low-privileged user to invoke functionality that la
Privilege escalation in Microsoft SharePoint allows an authenticated attacker with low-level privileges to gain elevated
Exploit-DB