Microsoft SharePoint EUVD-2026-99832

Exploitation requires an authenticated SharePoint user with at least low privileges (PR:L) who has network access to the SharePoint Server Subscription Edition instance; it is NOT remote-unauthenticated. The weakness is an observable discrepancy (CWE-203), so the attacker must be able to issue requests and compare response content, timing, or error signals to extract or manipulate information. HIGH attack complexity (AC:H) limits exploitation: the attacker must satisfy conditions outside their direct control (e.g., winning a timing/race window or specific server state), and no user interaction is needed (UI:N). The primary limiting factors are the required valid account, the non-trivial conditions behind AC:H, and the absence of any known automation (SSVC Automatable=no).

This is a moderate-priority issue with multiple signals pointing toward limited real-world urgency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N) scores 6.8 and indicates network reach but HIGH attack complexity and the need for at least low-level privileges (PR:L), meaning an attacker must already be an authorized/authenticated SharePoint user and must win a race or satisfy specific conditions implied by the observable-discrepancy weakness (CWE-203). CISA's SSVC framework reinforces a lower tier: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably scripted at scale), though Technical Impact=total. There is no CISA KEV listing and no public POC, so exploitation status is 'no public exploit identified at time of analysis.' A notable CONFLICT exists in the source data: the description characterizes the flaw as 'tampering' (an integrity action) and the CVSS claims C:H/I:H, yet CWE-203 (Observable Discrepancy) and the 'Information Disclosure' tag describe a confidentiality/information-leak weakness - verify the true impact with Microsoft's MSRC advisory, as the tampering framing and the information-disclosure classification are not consistent. Net: a high-CVSS-leaning but low-real-risk-at-present issue given PR:L, AC:H, SSVC none/no, and absence of any exploit evidence; patch on a normal cycle rather than emergency.

An authenticated low-privilege SharePoint user on the network sends crafted requests to a vulnerable Subscription Edition server and observes differences in responses, timing, or error behavior (the observable discrepancy) to infer protected information or manipulate state. Success requires winning the specific conditions behind the high attack complexity, and no public exploit code currently exists.