Microsoft SharePoint EUVD-2026-99065

Exploitation requires an attacker to already hold a valid, low-privileged authenticated account on a Microsoft SharePoint Server Subscription Edition farm (PR:L) running a build below 16.0.20326.20190; the flaw is an incorrect authorization check (CWE-863) that lets that authenticated user perform actions beyond their intended permission level. No user interaction is needed (UI:N) and the vector is network-reachable (AV:N) with low complexity (AC:L). LIMITING FACTORS: the mandatory pre-existing authenticated foothold substantially narrows the attacker population; impact is limited to low integrity effect with no confidentiality or availability loss and no scope change, and the issue affects only the Subscription Edition within the specified version range, so patched or other SharePoint editions are out of scope.

This is a moderate-severity elevation-of-privilege flaw (CVSS 4.3) that signals genuine but limited real-world risk rather than an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) shows network reachability and low attack complexity with no user interaction, but it explicitly requires prior low-level privileges (PR:L) - meaning the attacker must already hold a valid, authenticated SharePoint account. Impact is confined to a low integrity effect (I:L) with no confidentiality or availability loss and no scope change, which is why the score lands in the Medium band. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation-likelihood signals are entirely absent; the absence of KEV/POC is not evidence of safety, merely of no observed public exploitation. The one 'Authentication Bypass' tag conflicts with the actual nature of the flaw: CWE-863 (Incorrect Authorization) plus PR:L describes an already-authenticated user escalating privileges, not bypassing authentication - treat the tag as imprecise. Net: a real patch-worthy issue for internet- or intranet-exposed SharePoint, but a lower priority than an unauthenticated or high-impact bug absent any evidence of active exploitation.

An attacker who already possesses a low-privileged authenticated account on a SharePoint Server Subscription Edition farm sends crafted requests that the server fails to authorize correctly, allowing them to perform actions reserved for higher-privileged users and tamper with content or settings (integrity impact). No public exploit code or active-exploitation evidence was identified at the time of analysis, and no user interaction is required.