EUVD-2026-99729
GHSA-77gw-4c87-g3xj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege SharePoint credentials
-
DeliverySend crafted request over network
-
ExploitTrigger heap buffer overflow (CWE-122)
-
ExecutionExecute arbitrary code on server
-
ImpactFull compromise of SharePoint host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to hold valid low-privilege credentials on the target SharePoint deployment (CVSS PR:L; described as an 'authorized attacker'), after which no user interaction is needed and the attack is delivered over the network (AV:N/UI:N) against SharePoint Server Subscription Edition 16.0.0 builds prior to 16.0.20326.20190. The vendor summary does not name the specific vulnerable feature, handler, or configuration, so no non-default setting is documented as a prerequisite. The primary limiting factor is the authentication requirement - an anonymous internet attacker cannot exploit this directly - which, combined with SSVC Automatable:no, constrains realistic risk to authenticated users, insiders, or post-foothold lateral movement. |
| Impact | This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring no user interaction but requiring some level of authentication (PR:L), yielding total compromise of confidentiality, integrity, and availability on the affected SharePoint host (C:H/I:H/A:H, score 8.8). The heap overflow (CWE-122) leading to remote code execution is consistent with that impact. However, the mitigating signals are strong: CISA's SSVC decision framework records Exploitation as 'none' and Automatable as 'no' (while Technical Impact is 'total'), the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced - so the current status is 'no public exploit identified at time of analysis.' No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. The chief limiting factor is PR:L: the attacker must already hold a valid, low-privilege SharePoint account, which narrows this from internet-scale opportunistic attack toward authenticated/insider or post-foothold scenarios. Net: patch promptly given the total-impact RCE on a high-value collaboration server, but it is not yet in the actively-exploited, drop-everything category - the SSVC 'no automatable / no active exploitation' signals argue against mass-exploitation at this time. |
| Exploit ScenarioDerived | An attacker who already possesses valid low-privilege credentials for a SharePoint Server Subscription Edition site sends a crafted request to a vulnerable endpoint, triggering a heap-based buffer overflow that corrupts memory and allows arbitrary code execution on the server. No user interaction is required and the attack is over the network, but authentication is a prerequisite. No public exploit code has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.20326.20190, where a heap-based buffer overflow (CWE-122) can be triggered over the network by an attacker holding valid low-privilege credentials, with no user interaction required. A vendor patch is available, and intelligence sources indicate no public exploit identified at time of analysis and SSVC exploitation: none, so this is a credible but not emergency-tier priority primarily constrained by the authentication requirement.
RemediationAI
Vendor-released patch: upgrade Microsoft SharePoint Server Subscription Edition to 16.0.20326.20190 or later; Microsoft's advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88155. Because the attack requires valid low-privilege credentials and no non-default precondition is documented, there is no specific feature to disable; if immediate patching is not possible, restrict authenticated access to SharePoint to trusted accounts and networks, enforce least-privilege SharePoint roles, and monitor authenticated sessions for unexpected server-side process creation or heap-corruption crashes. The trade-off is that restricting access or roles can disrupt legitimate collaboration and may generate false positives, so prioritize the patch and use compensating controls only temporarily.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a heap-based buffer overflow (CWE-122), a memory-safety flaw in which a program writes beyond the bounds of a heap-allocated buffer, corrupting adjacent heap metadata or objects and potentially enabling arbitrary code execution under the SharePoint server process. The affected technology is Microsoft SharePoint Server Subscription Edition, an on-premises collaboration and document-management platform; EUVD identifies the vulnerable range as 16.0.0 builds before 16.0.20326.20190, and no CPE string is provided in the available data. The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector and the independent assessment both confirm network delivery, low privileges required, no user interaction, and high confidentiality, integrity, and availability impact; the vendor summary does not name the specific vulnerable feature, handler, or configuration, and SSVC records Automatable: no with total technical impact.
Know when Sharepoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable RCE needing a valid low-privilege SharePoint account (PR:L) and no user interaction (UI:N); heap overflow yields full host compromise, so C/I/A all High.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Executive ViewAI
Microsoft SharePoint Server Subscription Edition deployments running builds older than 16.0.20326.20190 are exposed to a network-reachable memory corruption flaw (CVE-2026-88155, CVSS 8.8) that can allow an attacker to execute code on the server without any user interaction, provided they already hold valid low-privilege credentials. SharePoint typically stores and processes the organization's most sensitive business content, so a compromise could expose or corrupt documents, disrupt collaboration for the entire workforce, and serve as a foothold for lateral movement into internal networks. Although no public exploit code or active exploitation has been observed, the availability of a vendor fix and the low skill floor for credential-based attacks make timely remediation a leadership-level priority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
More in Sharepoint
View allRemote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authen
SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted
Authenticated code injection in Microsoft SharePoint (CVSS 3.1 base 8.8) allows a remote attacker holding a valid low-pr
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190)
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.
Authenticated path traversal in Microsoft SharePoint Server can be escalated to code execution over the network, allowin
Privilege escalation in Microsoft SharePoint Server Subscription Edition before build 16.0.20326.20190 allows a remote l
Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated remote attacker holding
Privilege elevation in Microsoft SharePoint Server Subscription Edition lets any attacker who already holds a valid low-
Privilege escalation in Microsoft SharePoint allows an authenticated low-privileged user to invoke functionality that la
Privilege escalation in Microsoft SharePoint allows an authenticated attacker with low-level privileges to gain elevated
Exploit-DB