EUVD-2026-56722
GHSA-92r3-28gr-fr7w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network vector and low complexity confirmed; PR:L upheld because initial authenticated access is required before invoking the unprotected function.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Missing authentication for critical function in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Microsoft SharePoint Server (2016 Enterprise, 2019, and Subscription Edition) allows a low-privileged authenticated attacker to gain elevated access over the network by invoking a critical internal function that lacks proper authentication enforcement. The flaw (CWE-306) is exploitable with low complexity and no user interaction, resulting in full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity against a widely-deployed enterprise platform makes this a priority patching target.
Technical ContextAI
SharePoint Server is Microsoft's enterprise collaboration and document management platform, running as a web application on Windows Server infrastructure. CWE-306 (Missing Authentication for Critical Function) indicates that a privileged internal operation - such as a site administration API, permission management endpoint, or server-side function - fails to enforce authentication or authorization checks before execution. An attacker who holds any valid SharePoint credential can reach this function over the network and invoke it without the elevated rights it should require. Affected CPE strings span three major release tracks: SharePoint Server Subscription Edition (16.0.0 through 16.0.19725.20522), SharePoint Enterprise Server 2016 (16.0.0 through 16.0.5565.1001), and SharePoint Server 2019 (16.0.0 through 16.0.10417.20198). The CVSS vector AV:N/AC:L/PR:L confirms network reachability with minimal prerequisites beyond a valid low-privilege account.
RemediationAI
Apply the vendor-released patches immediately: upgrade SharePoint Server Subscription Edition to 16.0.19725.20522 or later, SharePoint Enterprise Server 2016 to 16.0.5565.1001 or later, and SharePoint Server 2019 to 16.0.10417.20198 or later. Patch details and download links are available through the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64921. If immediate patching is not possible, restrict network access to SharePoint administrative and API endpoints at the perimeter or internal firewall layer to limit exposure to known, trusted IP ranges - note this may disrupt remote workers and requires VPN enforcement. Additionally, audit SharePoint user accounts and remove unnecessary low-privilege accounts to reduce the attacker pool. Monitor SharePoint ULS logs for anomalous privilege escalation events or unexpected access to administrative functions. No vendor-documented workaround is available in the provided data.
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Ap
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today