What is the CVSS score of EUVD-2026-56766?

EUVD-2026-56766 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of SharePoint are affected by EUVD-2026-56766?

A privilege escalation vulnerability in Microsoft Office SharePoint (CVE-2026-70326, CVSS 8.8) allows any authenticated user to bypass access controls and achieve full system compromise, threatening…. A patch is available.

How to fix or mitigate EUVD-2026-56766?

Within 24 hours, conduct a complete inventory of all Microsoft SharePoint instances across the organization and document all users with authentication privileges to identify exposure scope. Within 7 days, implement network segmentation to restrict SharePoint access to designated trusted networks, enable comprehensive audit logging of all authenticated user activities and forward logs to your SIEM, and review user access permissions to eliminate unnecessary privileged accounts. Within 30 days, establish continuous behavioral monitoring to detect exploitation attempts, evaluate alternative collaboration platforms pending vendor patch availability, and conduct targeted penetration testing of SharePoint instances to identify potential exploitation paths in your specific configuration.

SharePoint EUVD-2026-56766

| CVE-2026-70326 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-11 secure@microsoft.com

GHSA-4pg5-gw5q-8554

SSRF Microsoft Sharepoint Server

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network vector confirmed by description; PR:L reflects required authenticated access; S:U because privilege escalation stays within SharePoint system boundary.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 17:52 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 8.8

DescriptionCVE.org

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation via SSRF in Microsoft Office SharePoint exposes authenticated users to full system compromise - confidentiality, integrity, and availability all rated High. The CVSS vector (PR:L/AV:N/AC:L/UI:N) confirms that any authenticated SharePoint user can trigger the vulnerability over the network without additional complexity. No active exploitation or public exploit code has been identified at time of analysis, though the low attack complexity and broad privilege impact make this a credible near-term risk.

Technical ContextAI

CWE-918 (Server-Side Request Forgery) describes a class of flaw in which a server-side application fetches a resource at a URL or address supplied or influenced by an attacker, bypassing network controls that would otherwise prevent the attacker from accessing internal services directly. In the context of Microsoft Office SharePoint - a widely deployed ASP.NET-based collaboration platform running on IIS - this likely involves a crafted request that causes the SharePoint server process to issue HTTP or SMB calls to internal infrastructure, which is then leveraged to escalate privileges. SharePoint's server-side components run with elevated system privileges, making SSRF particularly dangerous as a privilege escalation vector, potentially reaching internal APIs, credential endpoints, or metadata services inaccessible from the external network.

RemediationAI

The primary remediation is to apply the patch issued by Microsoft via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70326. An exact fixed version number is not available in the provided intelligence and should be obtained directly from the MSRC advisory before deploying. As a compensating control pending patching, organizations may restrict SharePoint access to explicitly required authenticated users only, reducing the pool of potential attackers who hold the PR:L-level credentials needed for exploitation. Additionally, outbound network filtering from SharePoint servers to internal infrastructure (blocking server-initiated requests to internal metadata services, internal APIs, and non-routable RFC-1918 ranges) directly reduces the impact of the SSRF primitive by limiting which internal resources an attacker can reach. Note that overly aggressive egress filtering on SharePoint may disrupt legitimate integration workflows and should be tested before broad deployment.