Microsoft SharePoint EUVD-2026-99043

Exploitation requires an existing authenticated foothold: per PR:L the attacker must already hold valid low-privileged SharePoint credentials or an authenticated session on the target server, reachable over the network (AV:N). No user interaction is needed (UI:N) and attack complexity is low (AC:L). The limiting factor is the authentication requirement - this is not a pre-authentication flaw, so defenders can reduce exposure by restricting SharePoint access, enforcing MFA, and limiting low-privilege account provisioning. The input does not specify a required non-default feature, configuration mode, or affected version, so the exact vulnerable component and whether specific SharePoint editions/builds are in scope must be confirmed from the Microsoft advisory.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-exploitable, low-complexity privilege escalation requiring only low-level privileges (PR:L) and no user interaction, yielding high confidentiality, integrity, and availability impact - consistent with a flaw letting an authenticated low-privileged SharePoint user elevate to higher (likely farm/admin) privileges. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is tempered by the PR:L requirement: an attacker must already hold valid credentials or an authenticated foothold, so this is a post-authentication escalation rather than a pre-auth internet-facing worm candidate. Given SharePoint's large enterprise footprint and Microsoft's history of SharePoint flaws being chained and later exploited, this warrants prompt patching, but on current signals it is a credible priority rather than confirmed emergency. Note the tag conflict: the input is tagged 'Authentication Bypass' (CWE-284 is Improper Access Control / elevation of privilege), which are related but distinct - treat the auth-bypass framing with caution and verify against the Microsoft advisory.

A low-privileged but authenticated SharePoint user (e.g. an internal employee or an attacker who phished a standard account) sends crafted requests to the SharePoint server exploiting the improper access-control check, bypassing authorization boundaries to perform actions reserved for higher-privileged roles. This grants elevated privileges enabling access to restricted content, site/farm configuration changes, or administrative control. No public exploit code is identified at time of analysis, and no user interaction is required (UI:N).