Microsoft SharePoint EUVD-2026-99044

Exploitation requires the attacker to already possess valid low-privileged authenticated access to the target SharePoint instance (CVSS PR:L), such as a standard site member, guest, or compromised low-tier account; it is not exploitable by a fully unauthenticated outsider. Given that condition, exploitation is network-reachable with low complexity and no user interaction (AV:N/AC:L/UI:N), meaning once a foothold exists the missing-authorization check can be abused directly against the SharePoint endpoint. The primary limiting factor is the need for pre-existing authentication; environments with tightly controlled SharePoint account provisioning and no low-trust/guest access reduce realistic exposure, while multi-tenant, extranet, or internet-facing SharePoint deployments that issue many low-privileged accounts are most at risk. Exact affected versions are not specified in the provided data and must be confirmed via the MSRC advisory.

This is a credible mid-to-high priority issue but not an emergency based on current signals. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with full compromise of confidentiality, integrity, and availability on the affected SharePoint instance - a classic privilege-escalation profile for a missing-authorization (CWE-862) flaw where any low-privileged authenticated user can perform actions reserved for higher-privileged accounts. However, several key signals are MISSING from the input: no EPSS exploitation-probability score was provided, there is no CISA KEV listing, and no public POC is referenced, so real-world exploitation likelihood cannot be quantified from the data at hand. There is no SSVC decision data (exploitation status, automatable, technical impact) supplied either. The CVSS vector and description are consistent (both point to a network-based privilege escalation by an already-authenticated actor), so there is no vector/description conflict to resolve. Net assessment: high technical impact and low exploitation barrier for anyone who already holds a foothold, but the requirement for valid authentication (PR:L) and the absence of KEV/EPSS/POC evidence mean this is best treated as a priority patch for internet-facing or multi-tenant SharePoint rather than an actively-exploited zero-day.

An attacker who already holds low-privileged credentials on a SharePoint site (for example a standard member or guest account, or a compromised low-tier user) sends crafted requests to a SharePoint endpoint that fails to properly check authorization, performing actions reserved for site administrators and thereby elevating their privileges across the network. Because no user interaction is required and attack complexity is low, the action can be repeated reliably once valid low-level access is obtained. No public exploit identified at time of analysis.