Microsoft SharePoint EUVD-2026-99713

Requires a valid low-privileged authenticated session on the affected Microsoft SharePoint Server Subscription Edition (16.0.0 before 16.0.20326.20190), per PR:L - unauthenticated exploitation is not indicated. No victim user interaction is needed (UI:N). The specific SSRF trigger (feature/endpoint and whether attacker-controlled URLs are accepted) is not detailed in the available data; exploitation is limited to confidentiality impact (information disclosure), with no integrity or availability effect. The principal limiting factor is the authentication requirement, so risk concentrates on farms where low-privileged accounts are broadly granted or internet-exposed.

This is a medium-severity, authenticated information-disclosure flaw whose real-world priority is moderate rather than urgent. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity attack that nonetheless requires low-privilege authentication (PR:L) - so an attacker must first have a valid SharePoint account, which meaningfully constrains opportunistic mass exploitation. Impact is confidentiality-only (C:H, I:N, A:N), consistent with an SSRF (CWE-918) used to disclose information by coercing the server to issue requests to internal/back-end resources. There is no CISA KEV listing and no POC referenced in the provided data, so exploitation status is 'no public exploit identified at time of analysis'; no EPSS score was supplied, so exploitation probability cannot be quantified from this input. No SSVC decision data was provided. The signals are internally consistent (network vector with an authentication requirement matches a typical authenticated SharePoint SSRF), with no contradiction between the CVSS vector and the description. Net: a real but not critical priority - patch within normal cycles, prioritized higher for internet-facing SharePoint farms where low-privileged accounts are broadly provisioned.

An attacker with a low-privileged authenticated SharePoint account submits a crafted request that causes the SharePoint server to make an attacker-controlled outbound request, returning the response contents to the attacker. This can be used to read internal-only resources or metadata endpoints not otherwise reachable. No public exploit code was identified in the provided data, and no user interaction by a victim is required (UI:N).