What is the CVSS score of EUVD-2026-56296?

EUVD-2026-56296 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.5%.

Is there a patch available for EUVD-2026-56296?

Yes, a patch is available for EUVD-2026-56296. Update the affected software to the latest version immediately.

Microsoft SharePoint EUVD-2026-56296

| CVE-2026-63512 MEDIUM

Incorrect Authorization (CWE-863)

2026-08-11 secure@microsoft.com

GHSA-cp5r-7qc8-wfqr

Authentication Bypass Microsoft Sharepoint Server

6.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable by any low-privilege authenticated user with no interaction required; impact is integrity-only as tampering does not expose or deny data.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 22:27 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

MEDIUM 6.5

DescriptionCVE.org

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.

AnalysisAI

Incorrect authorization in Microsoft SharePoint Server exposes authenticated network attackers to unrestrained content tampering across three supported product lines. The flaw, rooted in CWE-863 (Incorrect Authorization), allows a low-privileged but authenticated user to perform write or modification operations that server-side access controls should restrict to higher-privileged roles. Microsoft has released patches for all three affected versions; no public exploit code or CISA KEV listing exists at time of analysis.

Technical ContextAI

Microsoft SharePoint Server is an on-premises enterprise collaboration and document management platform built on the 16.0.x codebase, covering three distinct product editions: Subscription Edition, 2019, and 2016 Enterprise. CWE-863 (Incorrect Authorization) identifies the root cause as a failed or misconfigured permission enforcement check - the application authenticates the user correctly but then incorrectly validates whether that user's role permits a given modification action. This class of flaw differs from authentication bypass in that credentials are verified; the error lies in the post-authentication access decision logic. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms the vulnerability is reachable over the network, requires no elevated privileges beyond a valid account, and produces a high integrity impact with no confidentiality or availability consequence. The affected CPEs are cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*, cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*, and cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*.

RemediationAI

Apply the vendor-released patches immediately. For SharePoint Server Subscription Edition, upgrade to version 16.0.19725.20522 or later. For SharePoint Server 2019, upgrade to version 16.0.10417.20198 or later. For SharePoint Enterprise Server 2016, upgrade to version 16.0.5565.1001 or later. Patch downloads and deployment guidance are available through the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63512. Where immediate patching is not operationally feasible, restrict low-privilege user accounts to read-only site permissions as a compensating control - note this will prevent legitimate editing by standard users and requires careful scoping to avoid business disruption. Additionally, enable and review SharePoint's Unified Audit Log for anomalous modification events from accounts that should not have write access, which will not block exploitation but will support detection and response.