Microsoft SharePoint EUVD-2026-101506

Exploitation requires the attacker to hold a valid low-privilege SharePoint account (CVSS PR:L), so this is not usable by fully unauthenticated outsiders - the SharePoint site must be network-reachable from the attacker and the attacker must possess or obtain working credentials/a session. No user interaction and no special non-default configuration is indicated by the vector (UI:N, AC:L), meaning default deployments of Microsoft SharePoint Server Subscription Edition appear exploitable once authenticated. The primary limiting factor is therefore the authentication requirement; the primary amplifier is that low-privilege accounts are common and the authorization gap yields high confidentiality, integrity, and availability impact.

This is a credible priority for any organization running SharePoint Server Subscription Edition. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable flaw with low attack complexity, no user interaction, and only low-level privileges required - meaning any authenticated user (a condition trivially met in collaboration platforms with many internal or federated accounts) can exploit it, and the high C/I/A impacts reflect a full privilege escalation. The base score of 8.8 is consistent with this vector. That said, several corroborating signals are MISSING from the provided intelligence: there is no EPSS exploitation-probability score, no CISA KEV listing, and no indication of public POC code, so this analysis cannot assert active or imminent exploitation. The one-line description also conflicts mildly with the tagging: the vulnerability is CWE-862 Missing Authorization (an authorization-check gap), whereas the input Tags label it 'Authentication Bypass' - these are distinct weakness classes and the tag should be treated with caution. Net assessment: a genuinely serious authenticated network EoP in an enterprise product, worth prompt patching, but not evidenced as mass-exploited on the data provided.

An attacker who already holds a low-privilege SharePoint account (e.g., a standard internal user, a compromised credential, or a guest/federated identity) sends a crafted request to a SharePoint endpoint that fails to enforce an authorization check. Because no user interaction is required and attack complexity is low, the attacker escalates to higher privileges over the network. No public proof-of-concept exploit is identified in the provided data.