Microsoft SharePoint EUVD-2026-99045

Exploitation requires the attacker to already possess valid low-privileged credentials on the target SharePoint deployment (PR:L), reachable over the network (AV:N); no user interaction is needed (UI:N) and attack complexity is low (AC:L). The limiting factor is the authentication requirement - an anonymous, fully unauthenticated attacker cannot exploit this, so the realistic threat population is existing authenticated users, compromised accounts, or attackers who can self-register on exposed farms. Specific affected SharePoint versions, editions (Server vs. SharePoint in Microsoft 365), and the exact vulnerable feature or endpoint are not specified in the available data and should be confirmed from the MSRC advisory.

This is a genuine priority despite limited external intelligence. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a low-complexity, network-reachable privilege escalation requiring only low-level authenticated access (PR:L) and no user interaction, yielding full confidentiality, integrity, and availability impact - a classic profile for an authenticated-user-to-elevated-privilege attack in a collaboration platform. No EPSS score was supplied in the input, and there is no CISA KEV listing or public POC indicated, so exploitation probability cannot be quantified from this data. The only reference is the vendor's MSRC advisory, so there is no SSVC decision data (automatable, exploitation status) to cross-reference. The combination of a high CVSS, a common authorization-flaw CWE (CWE-863) in SharePoint, and the historically heavy attacker interest in SharePoint means this should be treated as high-priority for patching even though no active exploitation or POC is currently confirmed. Note the tag 'Authentication Bypass' is slightly inconsistent with the data: CWE-863 and PR:L describe incorrect authorization for an already-authenticated user (privilege escalation), not an authentication bypass - verify the nature with the vendor advisory.

An attacker who already holds a low-privileged SharePoint account (for example, an ordinary site member or any authenticated user on an internal or internet-facing farm) sends crafted requests that exploit the incorrect authorization check to perform actions reserved for higher-privileged roles. Because no user interaction is required and attack complexity is low, the attacker can reliably elevate to elevated privileges over the network. No public exploit identified at time of analysis, so this scenario is inferred from the CVSS vector rather than observed exploit code.