Microsoft SharePoint Server EUVD-2026-102464

Exploitation requires a valid authenticated SharePoint session: the CVSS PR:L and the description's 'authorized attacker' both indicate the attacker must already possess at least low-privilege credentials on the target SharePoint Server Subscription Edition instance, which is the primary limiting factor. Beyond authentication, no special non-default configuration, user interaction (UI:N), or elevated administrative role is indicated - the flaw is reachable over the network (AV:N) with low complexity (AC:L) against a running SharePoint deployment. Realistic risk is therefore gated chiefly by how easily an attacker can obtain low-privilege access, which is often feasible in large organizations with many SharePoint users or exposed sign-in.

This is a credible priority for patching, though not a drop-everything emergency on current evidence. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low privileges (PR:L) and no user interaction, yielding high confidentiality, integrity, and availability impact (C:H/I:H/A:H) for a composite 8.8 - consistent with authenticated remote code execution on SharePoint. The description's 'authorized attacker' language aligns cleanly with PR:L, so the signals are internally consistent rather than conflicting. However, several exploitation-maturity signals are ABSENT from the input: no EPSS probability was provided, the vulnerability is NOT listed in CISA KEV, and no public POC is indicated - so there is no public exploit identified at time of analysis. The main risk driver is SharePoint's status as a frequently-targeted, internet-facing collaboration platform where valid low-privilege credentials are often obtainable in enterprise environments, combined with a vendor patch already being available (which can enable patch-diffing to accelerate exploit development). Net: high-severity and realistically exploitable by an authenticated attacker, but current data shows no confirmed active exploitation, so treat as high-priority scheduled patching rather than evidence of ongoing campaigns.

An attacker holding a low-privilege authenticated SharePoint account (or who has phished/obtained such credentials) sends a crafted request containing a traversal sequence that escapes the intended restricted directory, causing the server to process attacker-controlled input as code and execute it over the network. No user interaction is required and attack complexity is low, so a single valid session is sufficient. No public exploit code was identified in the provided data.