Microsoft SharePoint Server EUVD-2026-99737

Exploitation requires the attacker to already possess valid authenticated access to the SharePoint deployment (CVSS PR:L); this is not a pre-auth flaw, so an unauthenticated external actor cannot exploit it without first obtaining credentials or an account. The vulnerable component is a SharePoint function that omits a required authorization check (CWE-862), so exploitation targets that function over the network (AV:N) with no user interaction and low complexity. Affected deployments are Microsoft SharePoint Server Subscription Edition 16.0.0 prior to build 16.0.20326.20190; patched builds are not exploitable. Limiting factors: the mandatory low-privilege authenticated foothold, and CISA's assessment that the flaw is not automatable, which constrains mass exploitation.

This is a credible mid-tier priority rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) signals a network-reachable, low-complexity flaw needing no user interaction and only low privileges, with total CIA impact - consistent with the CWE-862 missing-authorization pattern where an already-authenticated low-privilege user escalates. However, CISA's SSVC framework tempers this: Exploitation is rated 'none' (no observed or public exploitation), Automatable is 'no' (meaning it cannot be trivially scripted into mass/wormable attacks despite the network vector), while Technical Impact is 'total' (agreeing with the C:H/I:H/A:H impact). There is no CISA KEV listing and no EPSS score supplied, and no public exploit is referenced, so there is no evidence of active or at-scale exploitation at this time. The one genuine prerequisite - the attacker must already hold a valid authenticated account on the SharePoint deployment (PR:L) - meaningfully narrows the realistic threat to insiders, compromised credentials, or environments with broad self-service/guest access. Net: a high-impact but exploitation-gated authorization flaw that merits prompt patching on internet-exposed or multi-tenant SharePoint, but the signals do not indicate widespread opportunistic exploitation.

An attacker who already holds a low-privilege authenticated account on a SharePoint Server Subscription Edition site (e.g. a standard member, or a user acting on stolen credentials) sends a crafted network request to a function that fails to enforce an authorization check, letting them perform actions or read/modify content reserved for higher-privileged roles. Because no user interaction is required and attack complexity is low, the escalation can be performed directly once access exists. No public exploit code is identified at time of analysis, and CISA's SSVC rates the issue as not automatable, suggesting any exploitation would be manual/targeted rather than mass-scale.