Microsoft SharePoint EUVD-2026-99049

Exploitation requires network reachability to a Microsoft Office SharePoint server and the ability to present a cryptographic token/signature that the server fails to validate correctly (consistent with the JWT-attack/authentication-bypass tags). Per CVSS, no prior authentication (PR:N) and no user interaction (UI:N) are needed, so default internet- or intranet-exposed SharePoint instances are in scope. The key LIMITING factor is high attack complexity (AC:H): the attacker must satisfy a specific condition - such as defeating or forging a particular signature/key check or winning a timing/configuration-dependent condition - rather than sending a single trivial request, which constrains reliable, at-scale exploitation. Exact required SharePoint versions/builds were not provided and should be confirmed against the Microsoft MSRC advisory.

This is a high-severity (CVSS 8.1) improper-signature-verification flaw (CWE-347) in Microsoft SharePoint with full confidentiality, integrity, and availability impact (C:H/I:H/A:H). The CVSS vector confirms a network-reachable, unauthenticated vector (AV:N/PR:N/UI:N), which combined with the 'Authentication Bypass' and 'Jwt Attack' tags suggests an attacker can forge or replay a cryptographic token to gain elevated privileges without valid credentials - a pattern historically prone to mass exploitation in SharePoint. The one mitigating signal is high attack complexity (AC:H), indicating the attacker must win a race, defeat a specific cryptographic check, or satisfy conditions outside their control, which realistically slows commodity exploitation. No EPSS score, no CISA KEV listing, and no POC indicator were provided in the input, so there is NO current evidence of active exploitation or public exploit code; exploitation probability cannot be quantified from the available data. Net: treat as a genuine patch-priority item given SharePoint's attack surface and the unauthenticated network vector, but the absence of KEV/EPSS/POC signals means this is currently a 'patch promptly' rather than a 'confirmed emergency' item - the AC:H rating is the key reason it is 8.1 and not 9.8.

A remote, unauthenticated attacker crafts a forged or manipulated cryptographic token (consistent with the JWT-attack tag) and submits it to an internet-facing SharePoint server, exploiting the improper signature verification to be accepted as a higher-privileged principal. Because AC:H applies, success depends on defeating a specific cryptographic condition rather than a trivial single request. No public exploit code was identified in the provided intelligence at the time of analysis.