Microsoft SharePoint EUVD-2026-99061

Exploitation requires (1) a valid authenticated SharePoint account - the CVSS vector's PR:L confirms at least low-privilege credentials are needed, not anonymous access - and (2) network adjacency (AV:A), meaning the attacker must reach the server from an adjacent/logically-local network segment rather than across the open internet. The affected configuration is Microsoft SharePoint Server Subscription Edition at builds below 16.0.20326.20190. No user interaction is required (UI:N) and attack complexity is low (AC:L), so there are no timing or race conditions once the two preconditions are satisfied. The principal limiting factors defenders should weigh are the mandatory authentication and the adjacent-network requirement, which together exclude unauthenticated internet-based attackers.

This is a moderate-severity SSRF (CVSS 5.7, CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) that should be treated as a patch-management priority rather than an emergency. The vector constrains real-world risk in two important ways: AV:A means the attacker must be on an adjacent/logically-local network segment (not the open internet), and PR:L means valid low-level credentials are required - so this is not drive-by remote exploitation. Offsetting this, AC:L and UI:N mean that once those preconditions are met, exploitation is reliable and needs no victim interaction. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk assessment therefore rests on CVSS plus product exposure alone. One signal to verify: the CVSS vector encodes C:H (high confidentiality impact) while the description frames the outcome as 'spoofing,' which is Microsoft's usual labeling for SSRF where the server is coerced into making requests on the attacker's behalf - the C:H likely reflects disclosure of internal/back-end responses, but confirm the concrete impact with the MSRC advisory. Net: real but bounded risk, driven mainly by SharePoint's large enterprise footprint rather than by exploitation signals.

An attacker with a low-privileged SharePoint account and a foothold on an adjacent network segment submits a crafted request that causes the SharePoint server to issue an attacker-controlled server-side request to an internal resource. The server's privileged network position is abused to reach back-end services or return internal response data, enabling spoofing and disclosure of information the attacker could not reach directly. No public proof-of-concept was provided in the input, and low attack complexity (AC:L) with no user interaction (UI:N) makes the action reliable once credentials and network adjacency are obtained.