Microsoft SharePoint EUVD-2026-99722

Exploitation requires an authenticated session with at least low-level privileges on Microsoft SharePoint Server Subscription Edition (PR:L), meaning the attacker must hold or obtain valid credentials - this is the primary limiting factor and rules out anonymous internet-wide attacks. Beyond authentication, no special non-default configuration is indicated in the description: the flaw affects SharePoint Server Subscription Edition builds below 16.0.20326.20190, requires network reachability to the SharePoint web endpoints (AV:N), needs no user interaction (UI:N), and has low attack complexity (AC:L). Impact is limited to disclosure of information readable by the traversal; there is no integrity or availability effect (I:N/A:N). The exact vulnerable feature/endpoint is not named in the available data.

This is a moderate-priority, authenticated information-disclosure flaw rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) signals a network-reachable, low-complexity attack that nonetheless requires at least low-privilege authenticated access (PR:L) and yields only confidentiality impact (C:H) with no integrity or availability effect. These signals are mutually consistent with CISA's SSVC decision: Exploitation=none (no observed exploitation), Automatable=no (an attacker must first obtain valid SharePoint credentials/session, which cannot be reliably scripted at scale), and Technical Impact=partial (read-only data disclosure, not full compromise). There is no CISA KEV listing and no EPSS score was provided in the input, so exploitation-probability cannot be quantified here; absence of an EPSS value is a data gap, not evidence of low risk. No public exploit code is referenced. Net assessment: a credentialed SharePoint user (or an attacker who has phished/compromised one account) could read files outside the intended directory, which is meaningful in multi-tenant or least-privilege SharePoint deployments, but the authentication barrier and read-only, non-automatable nature keep this below the urgency of an unauthenticated RCE. The authentication requirement derived from PR:L is the single most important mitigating factor.

A low-privileged but authenticated SharePoint user (or an external attacker who has obtained valid credentials via phishing or credential reuse) sends a crafted request containing directory-traversal sequences to a vulnerable endpoint on SharePoint Server Subscription Edition. Because input is not properly constrained to the intended directory (CWE-22), the server returns the contents of files outside the permitted path, disclosing sensitive information over the network. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means exploitation is straightforward once valid access is held.