EUVD-2026-44036
GHSA-hggf-8h2q-j24h
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible SharePoint endpoint exploitable with any valid low-privilege account; path manipulation yields read-only file disclosure, with no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
External file path control in Microsoft SharePoint Enterprise Server 2016, Server 2019, and Server Subscription Edition allows authenticated low-privileged network attackers to perform spoofing, resulting in high confidentiality impact (C:H per CVSS). Exploitation requires no special configuration or user interaction, only a valid SharePoint account. No active exploitation is confirmed - SSVC rates exploitation as none, EPSS sits at 0.71% (49th percentile), and this CVE does not appear in CISA KEV - placing this as a medium-priority patching item despite its network-reachable, low-complexity attack profile.
Technical ContextAI
CWE-73 (External Control of File Name or Path) describes a class of vulnerabilities where software constructs file system paths using externally supplied input without adequate sanitization or canonicalization. In SharePoint's case, a server-side file-handling operation likely accepts user-controlled input that influences which file or resource is resolved and returned, enabling an attacker to redirect the operation to unintended paths. The three affected product lines - SharePoint Enterprise Server 2016, Server 2019, and Server Subscription Edition - all share the 16.0.x version lineage (CPE: cpe:2.3:a:microsoft:microsoft_sharepoint_enterprise_server_2016, cpe:2.3:a:microsoft:microsoft_sharepoint_server_2019, cpe:2.3:a:microsoft:microsoft_sharepoint_server_subscription_edition). The CVSS impact profile (C:H/I:N/A:N) is consistent with read-only unauthorized file disclosure driven by path manipulation, though the description's 'spoofing' classification introduces a slight ambiguity - spoofing typically implies impersonation rather than pure information disclosure, and the exact endpoint or feature involved is not specified in available data.
RemediationAI
Apply the vendor-released patches immediately: upgrade SharePoint Enterprise Server 2016 to build 16.0.5561.1001 or later, SharePoint Server 2019 to build 16.0.10417.20175 or later, and SharePoint Server Subscription Edition to build 16.0.19725.20434 or later. Patch details and installation instructions are published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54108. As a compensating control prior to patching, restrict SharePoint access to authenticated internal users only by placing the service behind a VPN or network perimeter control - this reduces the effective attack surface by removing internet-facing exposure, though it may disrupt external collaboration workflows. Additionally, enforcing strict input validation at a web application firewall layer for path traversal patterns (e.g., ../, %2F sequences) can reduce exploitability but should not be treated as a complete mitigation given the low attack complexity rating.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today