Microsoft SharePoint EUVD-2026-99706

Exploitation requires the attacker to already possess high (administrative) privileges on a Microsoft SharePoint Server Subscription Edition farm (CVSS PR:H), which is the primary limiting factor and means this is not reachable by anonymous or low-privileged users. No user interaction is required (UI:N) and the attack is carried out over the network (AV:N) with low complexity (AC:L). Affected builds are SharePoint Server Subscription Edition 16.0.0 prior to 16.0.20326.20190; applying that or a later build removes the condition. The CWE-829 root cause means the flaw hinges on SharePoint incorporating functionality from an attacker-controllable untrusted source, so an attacker-reachable untrusted control sphere (e.g., a configuration or component the privileged attacker can influence) is the concrete prerequisite.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) describes a network-reachable, low-complexity flaw that nonetheless requires high privileges (PR:H) and yields total compromise of confidentiality, integrity, and availability. This PR:H requirement is the dominant risk-limiting factor: an attacker must already hold elevated/administrative SharePoint rights before exploitation, which aligns with CISA SSVC scoring this 'Exploitation: none' and 'Automatable: no' while rating 'Technical Impact: total'. These signals are internally consistent - high impact but gated behind privilege, not mass-exploitable. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis. One data conflict must be flagged: the input Tag labels this 'Information Disclosure', but both the description ('execute code over a network') and the full C:H/I:H/A:H impact indicate remote code execution, not mere disclosure - treat the tag as mislabeled. Net assessment: a genuine high-severity RCE in a high-value enterprise product, but a privilege-gated, non-automatable issue that is a patch-prioritization item rather than an emergency given no observed exploitation.

An attacker who has already obtained high-privilege (administrative) access to a SharePoint Server Subscription Edition farm sends crafted network requests that cause SharePoint to include and execute functionality sourced from an attacker-controlled (untrusted) location (CWE-829), resulting in arbitrary code execution in the SharePoint context. No public exploit code is identified at time of analysis, and the attack requires no user interaction but does require pre-existing elevated privileges.