EUVD-2026-56775
GHSA-ph9c-74mv-vfx2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network vector and low complexity confirmed; PR:L because 'authorized attacker' requires valid credentials; C:H for internal resource disclosure via SSRF; no integrity or availability impact described.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Server-Side Request Forgery in Microsoft SharePoint Server 2016, 2019, and Subscription Edition enables authenticated network-adjacent attackers to coerce the SharePoint server into issuing outbound HTTP requests to attacker-controlled or internal network destinations, resulting in high-confidentiality-impact spoofing. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms exploitation is low-complexity, requires only a standard SharePoint account, and yields significant information disclosure with no integrity or availability loss. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
CWE-918 (Server-Side Request Forgery) describes a class of vulnerability in which a server-side application can be manipulated into making outbound HTTP/S or other protocol requests to destinations controlled by the attacker rather than intended infrastructure. Microsoft SharePoint Server is an enterprise collaboration and content management platform; its CPE strings (cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*, cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*, cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*) confirm the flaw spans three distinct product lines. SharePoint's extensive server-side processing of user-supplied URLs - common in web parts, external content types, REST API connectors, and workflow integrations - provides ample SSRF surface. Exploitation can allow an attacker to probe internal network topology, access cloud metadata endpoints (e.g., IMDS at 169.254.169.254), or retrieve credentials and tokens accessible only from the server's network position.
RemediationAI
Apply the Microsoft-released cumulative updates that address this vulnerability: for SharePoint Enterprise Server 2016, update to build 16.0.5565.1001 or later; for SharePoint Server 2019, update to build 16.0.10417.20198 or later; for SharePoint Server Subscription Edition, update to build 16.0.19725.20522 or later. Patch details and download links are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58639. If immediate patching is not feasible, consider restricting outbound HTTP/S connectivity from SharePoint server hosts using host-based firewall rules or network egress controls, limiting outbound destinations to known-good endpoints only - this mitigates the core SSRF impact (internal probing, metadata access) but may disrupt legitimate SharePoint integrations with external data sources. Additionally, review and restrict which users have access to SharePoint features that process external URLs (web parts, BCS external content types, workflow connectors) and audit recent SharePoint ULS logs for anomalous outbound requests to internal subnets or cloud metadata addresses.
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Ap
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today