Sharepoint Server
Monthly
Out-of-bounds read in Microsoft Excel enables remote code execution (CVSS 8.8) when a user opens or previews a specially crafted workbook, requiring user interaction (UI:R) but no attacker authentication (PR:N). Affected products include Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365/LTSC for Mac, Office Online Server, and SharePoint Server Subscription Edition builds prior to vendor-fixed versions, so server-side document rendering can broaden exposure. No public exploit identified at time of analysis, and vendor patches are available; the primary limiting factor is the required user action.
Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a low-privileged account escalate to full control over the affected farm, with high impact to confidentiality, integrity, and availability (CVSS 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable over the network with low complexity and no user interaction, but it is not pre-authentication - an attacker must first obtain or already possess valid SharePoint credentials. Affected are deployments of SharePoint Server Subscription Edition 16.0.0 prior to build 16.0.20326.20190; patched builds are not exploitable. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none, and Microsoft has released a vendor fix, so this is a high-priority but not emergency patch.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privileged user on the target farm coerce the server into issuing requests to attacker-influenced destinations, which Microsoft rates as a network-vector privilege elevation (CVSS 3.1 base 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not trivial: the assessed conditions require a valid low-privileged account (PR:L) plus environmental factors captured by AC:H - a reachable internal target, specific server configuration, and/or timing and state dependencies that the attacker does not fully control. Only SharePoint Server Subscription Edition builds 16.0.0 below 16.0.20326.20190 are affected, no user interaction is needed (UI:N), no public exploit was identified at time of analysis, and CISA's SSVC evaluation records Exploitation: none and Automatable: no, so this is a real but non-urgent patching priority rather than an emergency.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition (builds prior to 16.0.20326.20190) allows an authenticated user with a valid SharePoint account to plant script content that executes in the browser of another user who views the affected page, enabling spoofing and theft or manipulation of data within that victim's session context. The defect carries a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N), which reflects a meaningful prerequisite chain: the attacker must already hold an authenticated account (PR:L) and the payload only fires when a victim interacts with the crafted content (UI:R). There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so this is a moderate-priority vulnerability that merits scheduled patching rather than emergency response.
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated remote attacker holding only low-privilege credentials to elevate privileges over the network without any user interaction. The flaw is a privilege context switching error (CWE-270) affecting 16.0.0 builds below 16.0.20326.20190, and a vendor patch is available through the Microsoft Security Response Center. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable, so while technical impact is total, the practical risk is elevated rather than emergency-tier.
Privilege elevation in Microsoft SharePoint Server Subscription Edition lets any attacker who already holds a valid low-privilege account escalate to higher privileges over the network, because a SharePoint function performs an action without the required authorization check. Affected deployments are Subscription Edition builds below 16.0.20326.20190; patched builds are not exploitable. This is a credible mid-tier priority rather than a drop-everything emergency: exploitation requires an authenticated foothold (CVSS PR:L, so authentication requirements are confirmed as authenticated per vector PR:L), no user interaction is needed (UI:N), and CISA's SSVC assessment records exploitation as none and the flaw as not automatable, so no public exploit was identified at time of analysis and the barrier to mass exploitation is high. A vendor patch is available from Microsoft.
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) allows a low-privileged SharePoint user to run arbitrary code on the server over the network. Per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8), the attacker must already hold valid credentials for a SharePoint account - the vulnerable code path is not reachable by unauthenticated users - but no victim interaction is required, and the impact on confidentiality, integrity, and availability is total. The status of this vulnerability at the time of analysis is that no public exploit code has been identified; it is not listed in CISA KEV, so confirmed in-the-wild exploitation has not been established, though the low attack complexity and the common exposure of internet-facing SharePoint portals with broadly provisioned accounts make it a high-priority patch target.
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.20190) allows a low-privileged account holder to send crafted input over the network and corrupt heap memory, potentially gaining full control of the server's confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires only a valid low-privileged SharePoint account plus network reachability to the server - no user interaction - so any farm that issues accounts to untrusted or external users should treat this as high priority. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published a fixed build via its update guide (MSRC advisory CVE-2026-88163), making patching the straightforward path to closure.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.20326.20190, where a heap-based buffer overflow (CWE-122) can be triggered over the network by an attacker holding valid low-privilege credentials, with no user interaction required. A vendor patch is available, and intelligence sources indicate no public exploit identified at time of analysis and SSVC exploitation: none, so this is a credible but not emergency-tier priority primarily constrained by the authentication requirement.
Remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authenticated, low-privileged user of a SharePoint deployment send a malicious serialized payload over the network and obtain code execution with high confidentiality and integrity impact, requiring no user interaction from the victim. The issue is a CWE-502 deserialization-of-untrusted-data flaw rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and no public exploit has been identified at time of analysis; the decisive exposure factor is the PR:L authentication prerequisite, so practical risk concentrates in deployments where low-privilege, guest, or self-service accounts are broadly provisioned or can be obtained through credential compromise.
Authenticated code execution in Microsoft SharePoint Server Subscription Edition affects all builds from 16.0.0 up to (but not including) 16.0.20326.20190, allowing an attacker who already holds high (farm-administrative) privileges to run arbitrary code over the network with no user interaction. Because the CVSS vector is PR:H (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2), the flaw is not reachable by anonymous or low-privileged users, but for a privileged actor it yields complete loss of confidentiality, integrity, and availability. There is no CISA KEV listing and no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', although technical impact is assessed as total, and a vendor patch is available.
SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted input that is incorporated into a SQL command, giving the attacker arbitrary control over the back-end database and effectively elevating their privileges on the farm. Only SharePoint Server Subscription Edition builds below 16.0.20326.20190 are affected, the attack requires a valid account on the target instance (CVSS PR:L) and no user interaction, so anonymous internet exploitation is not possible; environments already at or above the patched build are not exposed. Microsoft has shipped a fix and no public exploit code has been identified at time of analysis, with CISA SSVC recording Exploitation as none and Automatable as no, making this a credible but not emergency-tier priority that should be fixed on a normal patch cycle - the high CVSS score of 8.8 reflects total loss of confidentiality, integrity and availability once the injection is successfully driven.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition (on-premises builds 16.0.0 below 16.0.20326.20190) lets an authenticated, low-privilege user coerce the SharePoint server into issuing HTTP requests to internal or otherwise unreachable endpoints, producing high confidentiality, integrity and availability impact and enabling privilege elevation over the network. The issue is rated CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), so an existing authenticated account is required and additional server-side conditions must be satisfied for the forgery to succeed, which materially limits reliability. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none', and Microsoft has published a vendor-released fix, making this a genuine but moderate-priority issue rather than a drop-everything emergency.
Privilege escalation in Microsoft SharePoint Server Subscription Edition before build 16.0.20326.20190 allows a remote low-privilege authenticated attacker to abuse an incorrect authorization check and gain elevated privileges. The flaw is network-reachable with low complexity and no user interaction, and it can result in high confidentiality, integrity, and availability impact (CVSS 8.8, PR:L). No public exploit was identified at time of analysis and CISA SSVC records exploitation as none and automatable as no; the vendor patch is available, and patched builds are not exploitable.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker with low privileges force the SharePoint application server to issue crafted requests on their behalf, which can expose sensitive internal resources and, per Microsoft's rating, enable privilege elevation over a network. The affected builds are SharePoint Server Subscription Edition versions earlier than 16.0.20326.20190, and exploitation requires network access plus a valid low-privileged account while also requiring attack-specific conditions that Microsoft captures as high complexity (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5). CISA's SSVC decision data records Exploitation: none, Automatable: no, and Technical Impact: total, so no public exploit code or in-the-wild activity is identified; the impact is nonetheless potentially total against confidentiality, integrity, and availability once the request-forgery primitive is chained successfully, and a vendor patch is available. This is a moderate-priority vulnerability that does not currently rise to emergency status.
Authenticated path traversal in Microsoft SharePoint Server can be escalated to code execution over the network, allowing an attacker holding a valid low-privileged account to fully compromise the confidentiality, integrity, and availability of the affected deployment. On-premises installations are affected: SharePoint Server Subscription Edition below build 16.0.20326.20190, plus SharePoint Server 2019 and SharePoint Enterprise Server 2016, all of which are reachable over the network with the attacker needing only PR:L credentials and no victim interaction (AV:N/AC:L/PR:L/UI:N). There is no public exploit identified at time of analysis and CISA's SSVC assessment marks the issue as not automatable, so while impact is rated total, the authentication prerequisite and lack of automation keep this an above-average-priority rather than emergency-level issue; Microsoft has published a vendor fix.
Authenticated remote code execution in Microsoft SharePoint allows a low-privileged user with network access to trigger deserialization of untrusted input, potentially running code on the server. The vulnerability requires a valid SharePoint account (PR:L), needs no user interaction (UI:N), and has low attack complexity (AC:L), but assessed impacts are limited to low confidentiality, integrity, and availability (CVSS 7.4, S:C). No public exploit or active exploitation is indicated in the provided intelligence, and this is a credible but moderate-priority vulnerability, with risk concentrated in environments where SharePoint accounts are broadly provisioned or the service is internet-exposed to authenticated users.
Unauthorized privilege elevation in Microsoft SharePoint is possible through improper verification of cryptographic signatures, allowing unauthenticated remote attackers to forge authentication tokens and gain elevated access. Rated CVSS 8.1, the flaw requires high attack complexity but no user interaction, and the JWT-attack tag indicates it likely involves defeating JSON Web Token signature checks. No public exploit has been identified at time of analysis.
Authenticated code injection in Microsoft SharePoint (CVSS 3.1 base 8.8) allows a remote attacker holding a valid low-privileged SharePoint account to run code in the server's context and elevate privileges, with low attack complexity and no user interaction required. The flaw is rooted in improper control of code generation (CWE-94) inside SharePoint, and the assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that the authentication prerequisite is the primary barrier - an outside attacker must first obtain or compromise a low-privileged credential, after which confidentiality, integrity, and availability are all fully impacted. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, so this should be treated as a high-priority patch item rather than an actively exploited emergency; the specific vulnerable endpoint is not named in the description and should be confirmed against the Microsoft MSRC advisory.
Privilege escalation in Microsoft SharePoint lets an authenticated, low-privileged user send crafted requests over the network and gain high-integrity read and write access across the affected deployment, yielding a CVSS v3.1 base score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires valid credentials on the target farm, so anonymous or fully unauthenticated attackers cannot trigger it; the realistic threat population is existing users, compromised accounts, or attackers who can self-register on internet-exposed farms. No CISA KEV entry and no public exploit code were identified at time of analysis, and no EPSS score was supplied - although external intelligence is sparse, the low attack complexity, network reachability, and lack of user interaction make this a genuine prioritisation item for SharePoint administrators.
Privilege escalation in Microsoft SharePoint allows an authenticated low-privileged user to invoke functionality that lacks a proper authorization check, yielding high confidentiality, integrity, and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N) without any user interaction. Only attackers who already hold a valid low-tier SharePoint account - a standard site member, guest, or compromised credential - can exploit this over the network; a fully unauthenticated outsider cannot. No public exploit code and no CISA KEV entry were identified at time of analysis, but the missing-authorization pattern is attractive for lateral escalation once a foothold exists, making multi-tenant, extranet, and internet-facing SharePoint deployments with liberal low-privilege account provisioning the highest-risk environments.
Privilege escalation in Microsoft SharePoint allows an authenticated attacker with low-level privileges to gain elevated access over the network without user interaction. The vulnerability arises from improper access control (CWE-284) and is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), enabling high impact to confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV as actively exploited.
Remote code execution in Microsoft SharePoint Server Subscription Edition is possible via a time-of-check time-of-use (TOCTOU) race condition exploitable by authenticated network attackers. The vulnerability, tracked as CWE-367, allows an attacker with at minimum standard SharePoint user credentials to trigger a race window during a file or resource state check, ultimately executing arbitrary code on the server. The CVSS vector (AV:N/AC:H/PR:L) reflects that exploitation requires winning a timing race, raising the bar above trivially automated attacks, but the full C:H/I:H/A:H impact means successful exploitation yields complete server compromise. No public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Microsoft SharePoint Server Subscription Edition allows an authenticated low-privileged network attacker to execute arbitrary code by exploiting a missing authorization check (CWE-862). The CVSS 8.8 score reflects network accessibility, low complexity, and full confidentiality, integrity, and availability impact against the affected server. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available targeting builds prior to 16.0.20326.20090.
SQL injection in Microsoft SharePoint Server Subscription Edition enables an authenticated low-privileged network attacker to escalate privileges, yielding full confidentiality, integrity, and availability compromise of the affected instance. The flaw (CWE-89) resides in insufficient neutralization of SQL special characters within SharePoint's server-side processing, allowing injected commands to reach the underlying SQL Server backend. A vendor patch is available at version 16.0.20326.20094; no public exploit has been identified at time of analysis.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition enables an authenticated low-privilege attacker to coerce the server into issuing arbitrary HTTP requests to internal or adjacent network resources, resulting in high-impact information disclosure. The CVSS scope-change flag (S:C) confirms that exploitation can expose resources beyond the SharePoint application boundary - including internal APIs, metadata services, or intranet hosts - making this a meaningful lateral-movement enabler despite its read-only impact. No public exploit code has been identified at time of analysis, and EPSS at 0.86% (56th percentile) suggests limited opportunistic exploitation so far.
Remote code execution in Microsoft SharePoint Server Subscription Edition is reachable by authenticated network users due to missing authorization checks (CWE-862). An attacker holding any valid SharePoint credentials can invoke privileged server-side functionality without proper authz enforcement, achieving full compromise of confidentiality, integrity, and availability. No active exploitation is confirmed in CISA KEV at time of analysis, and no public exploit code has been identified.
Privilege escalation in Microsoft SharePoint Server Subscription Edition enables any authenticated network user to gain elevated privileges with full confidentiality, integrity, and availability impact. The root cause is CWE-250 (Execution with Unnecessary Privileges), where a SharePoint service or component operates with more privilege than its function requires, allowing a low-privileged account to cross privilege boundaries. No active exploitation has been confirmed and no public exploit code has been identified; a vendor patch is available targeting build 16.0.20326.20090.
Remote code execution in Microsoft SharePoint Server Subscription Edition allows an authenticated low-privileged attacker to execute arbitrary code over the network by exploiting an improper access control flaw (CWE-284). The vulnerability affects build versions from 16.0.0 up to but not including 16.0.20326.20090, which Microsoft has patched. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Remote code execution in Microsoft SharePoint Server Subscription Edition allows any low-privileged authenticated user to execute arbitrary code on the server over the network via an improper access control flaw (CWE-284). The vulnerability carries a CVSS 8.8 with full C:H/I:H/A:H impact triad, meaning successful exploitation yields complete compromise of the SharePoint server. No confirmed active exploitation or public proof-of-concept is identified at time of analysis, but on-premises SharePoint deployments represent high-value enterprise targets warranting priority patching.
Remote code execution in Microsoft SharePoint Server Subscription Edition (below 16.0.20326.20090) allows a low-privileged authenticated attacker to execute arbitrary code over the network by exploiting improper access control. The flaw, rooted in CWE-284, permits an authorized user to exceed their intended permissions and trigger server-side code execution without any user interaction. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Privilege escalation via stored cross-site scripting in Microsoft SharePoint Server allows an authenticated low-privileged attacker to elevate their rights over a network by injecting malicious script that executes in a victim's browser session. Affected products include SharePoint Server 2019 and Subscription Edition with specific unpatched builds. No active exploitation has been confirmed - SSVC rates exploitation as none, EPSS stands at 0.42% (35th percentile), and the CVE is not listed in CISA KEV - though the CVSS-rated technical impact is classified as total due to high confidentiality and integrity compromise enabled by the scope change.
Privilege escalation via SSRF in Microsoft Office SharePoint exposes authenticated users to full system compromise - confidentiality, integrity, and availability all rated High. The CVSS vector (PR:L/AV:N/AC:L/UI:N) confirms that any authenticated SharePoint user can trigger the vulnerability over the network without additional complexity. No active exploitation or public exploit code has been identified at time of analysis, though the low attack complexity and broad privilege impact make this a credible near-term risk.
Server-side request forgery in Microsoft Office SharePoint enables low-privileged authenticated attackers to escalate privileges with no user interaction required, achieving high confidentiality, integrity, and availability impact. The flaw (CWE-918) allows a legitimate but low-privilege account holder to forge server-side HTTP requests, likely reaching internal administrative interfaces or credential endpoints inaccessible from the network perimeter. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution in Microsoft Office SharePoint allows an attacker authenticated with low privileges to execute arbitrary code over a network via unsafe deserialization of user-controlled data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms full confidentiality, integrity, and availability impact with no user interaction required. No public exploit code has been identified at time of analysis, and SharePoint is not currently listed in the CISA KEV catalog based on available data.
Cross-site scripting in Microsoft Office SharePoint lets a remote, unauthenticated attacker inject script that executes in a victim's browser session to conduct spoofing, provided the victim is lured into interacting with the malicious content. Microsoft rates it 9.3 (Critical) with a scope-changed vector, reflecting that injected script escapes into the victim's authenticated SharePoint context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Microsoft Office SharePoint exploits unsafe deserialization of attacker-controlled data over the network. An authenticated attacker with low-level network access can submit a crafted serialized payload that SharePoint deserializes without sufficient validation, resulting in full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, but the low attack complexity and high impact across all three security properties make this a critical remediation priority.
Remote code execution in Microsoft Office SharePoint enables any authenticated low-privileged user to execute arbitrary code on the server by submitting maliciously crafted serialized data over the network. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack requires no user interaction, low complexity, and only a standard SharePoint account - making this straightforward to weaponize within any organization whose SharePoint is network-accessible to internal users or external authenticated parties. No public exploit code or CISA KEV listing is identified at time of analysis, though SharePoint deserialization vulnerabilities have historically attracted rapid weaponization.
Remote code execution in Microsoft SharePoint Server allows a network-authenticated attacker with low-level privileges to execute arbitrary code by exploiting unsafe deserialization of attacker-controlled data. Both SharePoint Server 2019 and the Subscription Edition are confirmed affected, with patches available from Microsoft. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and full-triad impact (C:H/I:H/A:H) make this a high-priority patching target for enterprise environments.
Remote code execution in Microsoft SharePoint allows any authenticated, low-privileged network attacker to execute arbitrary code on the server by exploiting unsafe deserialization of attacker-controlled data (CWE-502). Three on-premises SharePoint Server product lines are confirmed affected - Enterprise Server 2016, Server 2019, and Server Subscription Edition - with fixed builds available from Microsoft. No public exploit code has been identified at time of analysis, but the low attack complexity and precedent of prior SharePoint deserialization CVEs being rapidly weaponized (e.g., CVE-2019-0604) make this a high-priority patching target for any organization running on-premises SharePoint.
Code injection (CWE-94) in Microsoft SharePoint Server exposes authenticated network users to high-impact compromise across confidentiality, integrity, and availability on unpatched servers running SharePoint 2016 Enterprise, 2019, or Subscription Edition. The CVSS 8.8 rating (AV:N/AC:L/PR:L) reflects network exploitation requiring only low-privileged credentials, though the CVE description characterizes the primary effect as spoofing rather than full remote code execution - a tension that deserves verification against the Microsoft MSRC advisory. No public exploit code and no CISA KEV listing have been identified at time of analysis, and SSVC rates exploitation as none and automatable as no, moderating the immediate response urgency.
Remote code execution in Microsoft SharePoint Server exposes organizations to full system compromise via deserialization of attacker-controlled data submitted over the network. Versions across three SharePoint Server editions (Subscription Edition, 2019, and Enterprise 2016) are confirmed affected, all requiring only a low-privileged authenticated account to exploit. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and high impact across confidentiality, integrity, and availability make this a critical-priority remediation item for any enterprise SharePoint deployment.
Privilege escalation in Microsoft SharePoint Server (2016 Enterprise, 2019, and Subscription Edition) allows a low-privileged authenticated attacker to gain elevated access over the network by invoking a critical internal function that lacks proper authentication enforcement. The flaw (CWE-306) is exploitable with low complexity and no user interaction, resulting in full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity against a widely-deployed enterprise platform makes this a priority patching target.
Remote code execution in Microsoft SharePoint Server allows any authenticated network attacker to execute arbitrary code by submitting a malicious serialized object payload to vulnerable endpoints. Three major SharePoint versions are affected - SharePoint Server 2016, 2019, and Subscription Edition - all running build versions below their respective patched thresholds. No public exploit code has been identified at time of analysis, but the low privilege requirement (any valid SharePoint account) and low attack complexity make this a high organizational priority, particularly given SharePoint's widespread enterprise deployment footprint.
Remote code execution in Microsoft SharePoint is achievable by unauthenticated network attackers exploiting improper input validation (CWE-20), with the 'Authentication Bypass' tag indicating the flaw may circumvent access controls entirely. Three active SharePoint product lines are confirmed affected - Enterprise Server 2016, Server 2019, and the Subscription Edition - across a defined version range for each. Vendor patches are available from Microsoft; no public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible, zero-privilege attack vector makes this a high-priority patching target.
Remote code execution in Microsoft SharePoint Server affects authenticated network users through unsafe deserialization of attacker-controlled data. Affected versions span SharePoint Server 2019, SharePoint Enterprise Server 2016, and SharePoint Server Subscription Edition - all running build numbers below the patched releases issued by Microsoft. An attacker with a valid low-privilege account can send a crafted payload over the network to trigger arbitrary code execution on the server without any user interaction, achieving full compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing is identified at time of analysis, but the low-complexity, network-reachable attack surface makes this a high-priority patching target.
Privilege escalation in Microsoft SharePoint allows an authenticated low-privilege attacker to elevate to higher permissions over a network, exploiting improper authentication logic (CWE-287). Three on-premises SharePoint versions are confirmed affected - Enterprise Server 2016, Server 2019, and the current Subscription Edition - with vendor-released patches available for all. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 score and full High C/I/A impact profile make this a serious priority for organizations running unpatched on-premises SharePoint.
Remote code execution in Microsoft Office SharePoint enables an authenticated attacker with low privileges to execute arbitrary code over the network when a victim user is induced to perform an action. The flaw stems from an improper authorization check (CWE-285) that fails to enforce expected access boundaries, yielding full confidentiality, integrity, and availability impact (CVSS 8.0). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Privilege escalation in Microsoft Office SharePoint allows an authenticated network attacker to elevate privileges by submitting maliciously crafted serialized data that the server deserializes without proper validation. The CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability combined with low attack complexity, though the PR:L requirement means the attacker must already hold at least a low-privileged SharePoint account. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Local code execution in Microsoft Office is possible through a heap-based buffer overflow (CWE-122) that an unauthenticated attacker can trigger when a user opens a crafted document. The CVSS 3.1 base score of 7.8 reflects high impact to confidentiality, integrity, and availability, with required user interaction limiting mass exploitation. There is no public exploit identified at time of analysis and the issue is not currently listed on the CISA KEV catalog.
Local code execution in Microsoft Office Word enables an attacker to run arbitrary code in the context of the current user by tricking them into opening a malicious document that triggers an untrusted pointer dereference. With a CVSS 7.8 score and no public exploit identified at time of analysis, the flaw is exploited locally but unauthenticated, relying on user interaction to open a crafted file. Microsoft has issued an advisory via the MSRC Security Update Guide.
Local code execution in Microsoft Office via a type confusion flaw (CWE-416) permits unauthorized attackers to run arbitrary code in the context of the Office process without requiring privileges or user interaction. The issue carries a high CVSS 3.1 score of 8.4 with full impact across confidentiality, integrity, and availability, though exploitation requires local attack vector access to the target system. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Local code execution in Microsoft Office stems from a type confusion (CWE-843) flaw that allows an unauthenticated attacker with local access to run arbitrary code in the context of the Office process. The CVSS 8.4 score reflects high impact on confidentiality, integrity, and availability without requiring privileges or user interaction, though the attack vector is local. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV.
Path traversal in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) enables an authenticated low-privileged attacker to execute code over a network by escaping the intended directory scope. Affected builds span all three actively maintained SharePoint Server product lines, with vendor-confirmed patches available for each. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog; however, the low attack complexity (AC:L) and no user interaction requirement (UI:N) make it a credible target for exploitation once an attacker has any valid SharePoint credential.
Local code execution in Microsoft Office is possible through a heap-based buffer overflow (CWE-122) that triggers when a user opens or previews a maliciously crafted document. The CVSS 7.8 score reflects local attack vector with required user interaction, and no public exploit identified at time of analysis. Successful exploitation yields full confidentiality, integrity, and availability impact in the context of the current user.
Local code execution in Microsoft Office is possible when a user opens a maliciously crafted document that triggers a heap-based buffer overflow (CWE-122), allowing the attacker to run arbitrary code in the context of the opened Office process. The CVSS 7.8 (AV:L/AC:L/PR:N/UI:R) reflects a user-interaction-driven local exploit rather than a remote network attack, and no public exploit identified at time of analysis. The flaw was reported through Microsoft Security Response Center (secure@microsoft.com) and is tracked in MSRC's update guide.
Remote code execution in Microsoft SharePoint Server through unsafe deserialization of untrusted data allows authenticated attackers to execute arbitrary code with high privileges over the network. The vulnerability requires valid user credentials but no user interaction, making it exploitable by any authorized account. No patch is currently available, leaving affected systems vulnerable until Microsoft releases a fix.
Unsafe pointer dereference in Microsoft Office, SharePoint Server, and 365 Apps enables local code execution with high privileges on affected systems. An attacker with local access can exploit this memory safety flaw to achieve complete system compromise including data theft and modification. No patch is currently available, leaving users vulnerable until Microsoft releases a security update.
Remote code execution in Microsoft SharePoint Server allows authenticated users to bypass input validation and execute arbitrary code across the network. This high-severity vulnerability (CVSS 8.8) affects authorized attackers who can leverage improper validation controls to achieve full system compromise. No patch is currently available, making immediate mitigation and access controls critical for affected organizations.
Microsoft SharePoint Server contains a reflected cross-site scripting vulnerability that allows remote attackers to execute arbitrary scripts in users' browsers through malicious links, enabling spoofing attacks and credential theft. The vulnerability requires user interaction to trigger and affects all SharePoint deployments with no available patch. With a CVSS score of 8.1, this poses a significant risk to organizations relying on SharePoint for collaboration.
Microsoft Outlook's unsafe deserialization of untrusted data enables remote attackers to spoof messages and identities without authentication over the network. This vulnerability affects Outlook, Word, and Microsoft 365 Apps, allowing attackers to impersonate legitimate senders and deceive users. No patch is currently available, making this a high-risk threat requiring immediate defensive measures.
Information disclosure in Microsoft Outlook, SharePoint Server, Office, and 365 Apps enables remote attackers to conduct email spoofing attacks without authentication or user interaction. The vulnerability affects multiple Microsoft collaboration products and could allow threat actors to impersonate legitimate senders to compromise organizational security. No patch is currently available for this high-severity issue.
Local code execution in Microsoft SharePoint Server results from inadequate input validation, enabling attackers with local access to execute arbitrary code with user interaction. The vulnerability affects SharePoint deployments and carries high impact across confidentiality, integrity, and authenticity. No patch is currently available.
Local code execution in Microsoft Office Word (including 365 Apps and SharePoint Server) results from unsafe pointer dereferencing that can be triggered by user interaction with a malicious document. An attacker with local access can exploit this vulnerability to execute arbitrary code with the privileges of the affected user. No patch is currently available for this vulnerability.
SQL injection in Microsoft SharePoint Server enables authenticated attackers to execute arbitrary code remotely through improper sanitization of database queries. This vulnerability affects authorized users with network access and could allow them to compromise affected systems with high-level privileges. No patch is currently available for this issue.
Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally. [CVSS 7.0 HIGH]
Microsoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over the network, with active exploitation confirmed and patches pending full release.
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated attackers to execute arbitrary code over the network. KEV-listed with EPSS 63.8%, this vulnerability requires only basic SharePoint authentication and enables server-level code execution, threatening the documents, workflows, and data stored across the organization's SharePoint infrastructure.
Microsoft SharePoint Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
Microsoft SharePoint Server Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Microsoft SharePoint Server Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Microsoft SharePoint Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework,. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Cross-site scripting (XSS) in Microsoft SharePoint Server 2019 allows remote attackers to inject malicious scripts into web pages viewed by other users, potentially leading to spoofing or limited data theft. Exploitation requires user interaction (e.g., clicking a crafted link) but no authentication, and it is not automatable. No public exploit code or active exploitation has been identified, and the overall risk is assessed as moderate due to the required victim interaction and limited impact.
Microsoft SharePoint Server Subscription Edition is affected by an observable-discrepancy weakness (CWE-203) that allows an authenticated, low-privileged user with network access to compare response content, timing, or error signals and use those differences to extract protected information and tamper with server-side data. Scope is limited to SharePoint Server Subscription Edition, and exploitation is not remote-unauthenticated: the attacker needs a valid account and must meet conditions outside their direct control (high attack complexity), so the issue is situational rather than mass-exploitable. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV not applicable; SSVC reports Exploitation: none, Automatable: no, Technical Impact: total), so the surrounding signals indicate limited real-world urgency for this moderate-severity issue.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition (16.0.0 prior to build 16.0.20326.20190) lets an attacker holding a valid, low-privileged SharePoint account inject content that is rendered in another user's browser, enabling spoofing and manipulation of page content. Exploitation requires the victim to view or interact with the attacker-controlled content, and impact is limited to low confidentiality and integrity with no availability effect, consistent with the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, score 4.6). There is no public exploit identified at time of analysis and CISA's SSVC assessment records no exploitation and no automatable attack path, making this a low-severity, low-priority issue; a vendor patch is available.
Stored cross-site scripting in Microsoft SharePoint Server Subscription Edition (16.0.0 builds prior to 16.0.20326.20190) allows an authenticated user who can author or edit content to inject script that later executes in the browser of a different user who views the affected page, resulting in spoofed page content. Exploitation requires a valid SharePoint account with content-editing rights and victim interaction, so it is neither unauthenticated nor zero-click; the assessed impact is limited to spoofing with low confidentiality and integrity consequences and no availability impact. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation, making this a low-priority, patch-on-normal-cycle issue rather than an emergency.
Path traversal in Microsoft SharePoint Server Subscription Edition allows an authenticated attacker to read files outside the intended content directory, resulting in disclosure of confidential information over the network. The flaw affects SharePoint Server Subscription Edition builds prior to 16.0.20326.20190 and carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), meaning exploitation requires valid low-privilege credentials, needs no user interaction, and cannot modify data or cause denial of service. CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis - the practical risk is concentrated on insiders or attackers holding stolen or low-privilege accounts rather than anonymous internet adversaries.
Path traversal (CWE-22) in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker read files outside an intended restricted directory over the network. Exploitation requires a valid low-privileged session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it is not an anonymous, internet-wide attack - the credential requirement is the primary limiting factor, and CISA's SSVC assessment rates it Exploitation: none, Automatable: no, Technical Impact: partial. Impact is confidentiality-only (no integrity or availability effect), and no public exploit code has been identified at time of analysis; Microsoft has released a vendor patch.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition lets an authenticated remote attacker with low privileges coerce the SharePoint server into making requests to destinations of the attacker's choosing, exposing information held on network-accessible resources that the server can reach (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Because the vector specifies PR:L, a valid low-privileged session on the affected build (16.0.0 before 16.0.20326.20190) is required and unauthenticated exploitation is not indicated; no user interaction is needed. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is a medium-priority, confidentiality-only issue whose urgency is driven by how widely low-privileged accounts are granted and whether the farm is internet-exposed.
Information disclosure in Microsoft SharePoint Server Subscription Edition lets an already highly privileged, authenticated attacker read confidential data over the network from an affected farm. Exploitation requires PR:H per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), so the practical exposure is limited to privileged insiders or adversaries who have already taken over a high-privilege account; there is no integrity or availability impact. The flaw carries a CVSS base score of 4.9 and, per CISA SSVC, exploitation has not been observed and the issue is not automatable; no public exploit code was identified at time of analysis. Microsoft has published a vendor fix, making this a medium-priority patching item rather than an emergency.
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated, low-privileged user to perform actions beyond their granted permissions over the network (CVSS 4.3, CWE-863) on builds below 16.0.20326.20190. Exploitation is constrained by the mandatory pre-existing valid account on the farm, and the impact is limited to a low integrity effect with no confidentiality or availability loss and no scope change. No public exploit code exists and the issue is not confirmed as actively exploited (CISA KEV); this is a moderate, vendor-patchable elevation-of-privilege issue rather than an emergency.
Improper input validation in Microsoft SharePoint Server Subscription Edition (versions 16.0.0 prior to 16.0.20326.20190) allows an attacker holding a valid low-privilege authenticated session to disclose confidential information over the network, with a CVSS 3.1 base score of 6.5. Because the vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the weakness is remotely reachable and trivially triggered once a session exists, but it cannot be exploited by a fully unauthenticated attacker and produces no integrity or availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a moderate-priority patch-and-monitor item rather than an emergency, though the high confidentiality rating means successful abuse could expose content the attacker is not entitled to read, and the affected server must be network-accessible to the attacker for exploitation.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authenticated attacker who can reach the server from an adjacent network segment make the SharePoint front end issue requests on their behalf, exposing internal services and data (CVSS 5.7, AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, confidentiality-only impact). Low-privilege credentials and adjacency are both mandatory preconditions, so unauthenticated internet-based attackers are excluded, and no user interaction or race conditions are involved. A vendor patch is available, no public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported, making this a patch-management priority rather than an emergency.
Incorrect authorization in Microsoft SharePoint Server Subscription Edition (versions below 16.0.20326.20190) allows an authenticated attacker with low privileges to disclose information over the network, with no user interaction required. The flaw is rooted in CWE-863 (Incorrect Authorization), meaning the server fails to properly validate whether a user is entitled to access certain data. No public exploit code or confirmed active exploitation is identified at time of analysis for CVE-2026-102865; the limiting factor is that the attacker must already hold valid low-privilege access, so realistic risk is highest in environments with many authenticated users or multi-tenant/shared SharePoint sites where cross-account disclosure matters.
Cross-site scripting (spoofing) in Microsoft SharePoint Server Subscription Edition lets an authenticated, authorized user submit crafted content that SharePoint renders without proper neutralization, causing attacker-controlled script to execute in a victim's browser session when that victim views the content. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) shows the two gating factors are valid authentication to the SharePoint instance and required victim interaction, with impact confined to low confidentiality and low integrity and no availability effect. The issue carries a CVSS base score of 4.6 and affects Subscription Edition builds before 16.0.20326.20190; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition, affecting builds before 16.0.20326.20190, allows an authenticated attacker with permission to insert content into a page rendered to other users to spoof page content or run script in a victim's browser once the victim views or interacts with the affected page. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, reflecting low confidentiality and integrity impact and a requirement for prior authentication plus victim interaction. No public exploit was identified at time of analysis, and the vendor has released a patch.
Server-side request forgery (SSRF) in Microsoft SharePoint Server Subscription Edition enables a low-privileged authenticated attacker to cause the server to issue outbound network requests, resulting in limited information disclosure. Exploitation requires user interaction in addition to a valid low-level account, constraining real-world impact to authenticated insider or phishing-assisted scenarios. No public exploit code has been identified, and the vulnerability carries a low CVSS base score of 3.5, reflecting its narrow confidentiality-only impact.
Out-of-bounds read in Microsoft Excel enables remote code execution (CVSS 8.8) when a user opens or previews a specially crafted workbook, requiring user interaction (UI:R) but no attacker authentication (PR:N). Affected products include Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365/LTSC for Mac, Office Online Server, and SharePoint Server Subscription Edition builds prior to vendor-fixed versions, so server-side document rendering can broaden exposure. No public exploit identified at time of analysis, and vendor patches are available; the primary limiting factor is the required user action.
Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a low-privileged account escalate to full control over the affected farm, with high impact to confidentiality, integrity, and availability (CVSS 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is reachable over the network with low complexity and no user interaction, but it is not pre-authentication - an attacker must first obtain or already possess valid SharePoint credentials. Affected are deployments of SharePoint Server Subscription Edition 16.0.0 prior to build 16.0.20326.20190; patched builds are not exploitable. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none, and Microsoft has released a vendor fix, so this is a high-priority but not emergency patch.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privileged user on the target farm coerce the server into issuing requests to attacker-influenced destinations, which Microsoft rates as a network-vector privilege elevation (CVSS 3.1 base 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not trivial: the assessed conditions require a valid low-privileged account (PR:L) plus environmental factors captured by AC:H - a reachable internal target, specific server configuration, and/or timing and state dependencies that the attacker does not fully control. Only SharePoint Server Subscription Edition builds 16.0.0 below 16.0.20326.20190 are affected, no user interaction is needed (UI:N), no public exploit was identified at time of analysis, and CISA's SSVC evaluation records Exploitation: none and Automatable: no, so this is a real but non-urgent patching priority rather than an emergency.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition (builds prior to 16.0.20326.20190) allows an authenticated user with a valid SharePoint account to plant script content that executes in the browser of another user who views the affected page, enabling spoofing and theft or manipulation of data within that victim's session context. The defect carries a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N), which reflects a meaningful prerequisite chain: the attacker must already hold an authenticated account (PR:L) and the payload only fires when a victim interacts with the crafted content (UI:R). There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so this is a moderate-priority vulnerability that merits scheduled patching rather than emergency response.
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated remote attacker holding only low-privilege credentials to elevate privileges over the network without any user interaction. The flaw is a privilege context switching error (CWE-270) affecting 16.0.0 builds below 16.0.20326.20190, and a vendor patch is available through the Microsoft Security Response Center. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable, so while technical impact is total, the practical risk is elevated rather than emergency-tier.
Privilege elevation in Microsoft SharePoint Server Subscription Edition lets any attacker who already holds a valid low-privilege account escalate to higher privileges over the network, because a SharePoint function performs an action without the required authorization check. Affected deployments are Subscription Edition builds below 16.0.20326.20190; patched builds are not exploitable. This is a credible mid-tier priority rather than a drop-everything emergency: exploitation requires an authenticated foothold (CVSS PR:L, so authentication requirements are confirmed as authenticated per vector PR:L), no user interaction is needed (UI:N), and CISA's SSVC assessment records exploitation as none and the flaw as not automatable, so no public exploit was identified at time of analysis and the barrier to mass exploitation is high. A vendor patch is available from Microsoft.
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) allows a low-privileged SharePoint user to run arbitrary code on the server over the network. Per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8), the attacker must already hold valid credentials for a SharePoint account - the vulnerable code path is not reachable by unauthenticated users - but no victim interaction is required, and the impact on confidentiality, integrity, and availability is total. The status of this vulnerability at the time of analysis is that no public exploit code has been identified; it is not listed in CISA KEV, so confirmed in-the-wild exploitation has not been established, though the low attack complexity and the common exposure of internet-facing SharePoint portals with broadly provisioned accounts make it a high-priority patch target.
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.20190) allows a low-privileged account holder to send crafted input over the network and corrupt heap memory, potentially gaining full control of the server's confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires only a valid low-privileged SharePoint account plus network reachability to the server - no user interaction - so any farm that issues accounts to untrusted or external users should treat this as high priority. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published a fixed build via its update guide (MSRC advisory CVE-2026-88163), making patching the straightforward path to closure.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.20326.20190, where a heap-based buffer overflow (CWE-122) can be triggered over the network by an attacker holding valid low-privilege credentials, with no user interaction required. A vendor patch is available, and intelligence sources indicate no public exploit identified at time of analysis and SSVC exploitation: none, so this is a credible but not emergency-tier priority primarily constrained by the authentication requirement.
Remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authenticated, low-privileged user of a SharePoint deployment send a malicious serialized payload over the network and obtain code execution with high confidentiality and integrity impact, requiring no user interaction from the victim. The issue is a CWE-502 deserialization-of-untrusted-data flaw rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and no public exploit has been identified at time of analysis; the decisive exposure factor is the PR:L authentication prerequisite, so practical risk concentrates in deployments where low-privilege, guest, or self-service accounts are broadly provisioned or can be obtained through credential compromise.
Authenticated code execution in Microsoft SharePoint Server Subscription Edition affects all builds from 16.0.0 up to (but not including) 16.0.20326.20190, allowing an attacker who already holds high (farm-administrative) privileges to run arbitrary code over the network with no user interaction. Because the CVSS vector is PR:H (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2), the flaw is not reachable by anonymous or low-privileged users, but for a privileged actor it yields complete loss of confidentiality, integrity, and availability. There is no CISA KEV listing and no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', although technical impact is assessed as total, and a vendor patch is available.
SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted input that is incorporated into a SQL command, giving the attacker arbitrary control over the back-end database and effectively elevating their privileges on the farm. Only SharePoint Server Subscription Edition builds below 16.0.20326.20190 are affected, the attack requires a valid account on the target instance (CVSS PR:L) and no user interaction, so anonymous internet exploitation is not possible; environments already at or above the patched build are not exposed. Microsoft has shipped a fix and no public exploit code has been identified at time of analysis, with CISA SSVC recording Exploitation as none and Automatable as no, making this a credible but not emergency-tier priority that should be fixed on a normal patch cycle - the high CVSS score of 8.8 reflects total loss of confidentiality, integrity and availability once the injection is successfully driven.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition (on-premises builds 16.0.0 below 16.0.20326.20190) lets an authenticated, low-privilege user coerce the SharePoint server into issuing HTTP requests to internal or otherwise unreachable endpoints, producing high confidentiality, integrity and availability impact and enabling privilege elevation over the network. The issue is rated CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), so an existing authenticated account is required and additional server-side conditions must be satisfied for the forgery to succeed, which materially limits reliability. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none', and Microsoft has published a vendor-released fix, making this a genuine but moderate-priority issue rather than a drop-everything emergency.
Privilege escalation in Microsoft SharePoint Server Subscription Edition before build 16.0.20326.20190 allows a remote low-privilege authenticated attacker to abuse an incorrect authorization check and gain elevated privileges. The flaw is network-reachable with low complexity and no user interaction, and it can result in high confidentiality, integrity, and availability impact (CVSS 8.8, PR:L). No public exploit was identified at time of analysis and CISA SSVC records exploitation as none and automatable as no; the vendor patch is available, and patched builds are not exploitable.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker with low privileges force the SharePoint application server to issue crafted requests on their behalf, which can expose sensitive internal resources and, per Microsoft's rating, enable privilege elevation over a network. The affected builds are SharePoint Server Subscription Edition versions earlier than 16.0.20326.20190, and exploitation requires network access plus a valid low-privileged account while also requiring attack-specific conditions that Microsoft captures as high complexity (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5). CISA's SSVC decision data records Exploitation: none, Automatable: no, and Technical Impact: total, so no public exploit code or in-the-wild activity is identified; the impact is nonetheless potentially total against confidentiality, integrity, and availability once the request-forgery primitive is chained successfully, and a vendor patch is available. This is a moderate-priority vulnerability that does not currently rise to emergency status.
Authenticated path traversal in Microsoft SharePoint Server can be escalated to code execution over the network, allowing an attacker holding a valid low-privileged account to fully compromise the confidentiality, integrity, and availability of the affected deployment. On-premises installations are affected: SharePoint Server Subscription Edition below build 16.0.20326.20190, plus SharePoint Server 2019 and SharePoint Enterprise Server 2016, all of which are reachable over the network with the attacker needing only PR:L credentials and no victim interaction (AV:N/AC:L/PR:L/UI:N). There is no public exploit identified at time of analysis and CISA's SSVC assessment marks the issue as not automatable, so while impact is rated total, the authentication prerequisite and lack of automation keep this an above-average-priority rather than emergency-level issue; Microsoft has published a vendor fix.
Authenticated remote code execution in Microsoft SharePoint allows a low-privileged user with network access to trigger deserialization of untrusted input, potentially running code on the server. The vulnerability requires a valid SharePoint account (PR:L), needs no user interaction (UI:N), and has low attack complexity (AC:L), but assessed impacts are limited to low confidentiality, integrity, and availability (CVSS 7.4, S:C). No public exploit or active exploitation is indicated in the provided intelligence, and this is a credible but moderate-priority vulnerability, with risk concentrated in environments where SharePoint accounts are broadly provisioned or the service is internet-exposed to authenticated users.
Unauthorized privilege elevation in Microsoft SharePoint is possible through improper verification of cryptographic signatures, allowing unauthenticated remote attackers to forge authentication tokens and gain elevated access. Rated CVSS 8.1, the flaw requires high attack complexity but no user interaction, and the JWT-attack tag indicates it likely involves defeating JSON Web Token signature checks. No public exploit has been identified at time of analysis.
Authenticated code injection in Microsoft SharePoint (CVSS 3.1 base 8.8) allows a remote attacker holding a valid low-privileged SharePoint account to run code in the server's context and elevate privileges, with low attack complexity and no user interaction required. The flaw is rooted in improper control of code generation (CWE-94) inside SharePoint, and the assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that the authentication prerequisite is the primary barrier - an outside attacker must first obtain or compromise a low-privileged credential, after which confidentiality, integrity, and availability are all fully impacted. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, so this should be treated as a high-priority patch item rather than an actively exploited emergency; the specific vulnerable endpoint is not named in the description and should be confirmed against the Microsoft MSRC advisory.
Privilege escalation in Microsoft SharePoint lets an authenticated, low-privileged user send crafted requests over the network and gain high-integrity read and write access across the affected deployment, yielding a CVSS v3.1 base score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires valid credentials on the target farm, so anonymous or fully unauthenticated attackers cannot trigger it; the realistic threat population is existing users, compromised accounts, or attackers who can self-register on internet-exposed farms. No CISA KEV entry and no public exploit code were identified at time of analysis, and no EPSS score was supplied - although external intelligence is sparse, the low attack complexity, network reachability, and lack of user interaction make this a genuine prioritisation item for SharePoint administrators.
Privilege escalation in Microsoft SharePoint allows an authenticated low-privileged user to invoke functionality that lacks a proper authorization check, yielding high confidentiality, integrity, and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N) without any user interaction. Only attackers who already hold a valid low-tier SharePoint account - a standard site member, guest, or compromised credential - can exploit this over the network; a fully unauthenticated outsider cannot. No public exploit code and no CISA KEV entry were identified at time of analysis, but the missing-authorization pattern is attractive for lateral escalation once a foothold exists, making multi-tenant, extranet, and internet-facing SharePoint deployments with liberal low-privilege account provisioning the highest-risk environments.
Privilege escalation in Microsoft SharePoint allows an authenticated attacker with low-level privileges to gain elevated access over the network without user interaction. The vulnerability arises from improper access control (CWE-284) and is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), enabling high impact to confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV as actively exploited.
Remote code execution in Microsoft SharePoint Server Subscription Edition is possible via a time-of-check time-of-use (TOCTOU) race condition exploitable by authenticated network attackers. The vulnerability, tracked as CWE-367, allows an attacker with at minimum standard SharePoint user credentials to trigger a race window during a file or resource state check, ultimately executing arbitrary code on the server. The CVSS vector (AV:N/AC:H/PR:L) reflects that exploitation requires winning a timing race, raising the bar above trivially automated attacks, but the full C:H/I:H/A:H impact means successful exploitation yields complete server compromise. No public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Microsoft SharePoint Server Subscription Edition allows an authenticated low-privileged network attacker to execute arbitrary code by exploiting a missing authorization check (CWE-862). The CVSS 8.8 score reflects network accessibility, low complexity, and full confidentiality, integrity, and availability impact against the affected server. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available targeting builds prior to 16.0.20326.20090.
SQL injection in Microsoft SharePoint Server Subscription Edition enables an authenticated low-privileged network attacker to escalate privileges, yielding full confidentiality, integrity, and availability compromise of the affected instance. The flaw (CWE-89) resides in insufficient neutralization of SQL special characters within SharePoint's server-side processing, allowing injected commands to reach the underlying SQL Server backend. A vendor patch is available at version 16.0.20326.20094; no public exploit has been identified at time of analysis.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition enables an authenticated low-privilege attacker to coerce the server into issuing arbitrary HTTP requests to internal or adjacent network resources, resulting in high-impact information disclosure. The CVSS scope-change flag (S:C) confirms that exploitation can expose resources beyond the SharePoint application boundary - including internal APIs, metadata services, or intranet hosts - making this a meaningful lateral-movement enabler despite its read-only impact. No public exploit code has been identified at time of analysis, and EPSS at 0.86% (56th percentile) suggests limited opportunistic exploitation so far.
Remote code execution in Microsoft SharePoint Server Subscription Edition is reachable by authenticated network users due to missing authorization checks (CWE-862). An attacker holding any valid SharePoint credentials can invoke privileged server-side functionality without proper authz enforcement, achieving full compromise of confidentiality, integrity, and availability. No active exploitation is confirmed in CISA KEV at time of analysis, and no public exploit code has been identified.
Privilege escalation in Microsoft SharePoint Server Subscription Edition enables any authenticated network user to gain elevated privileges with full confidentiality, integrity, and availability impact. The root cause is CWE-250 (Execution with Unnecessary Privileges), where a SharePoint service or component operates with more privilege than its function requires, allowing a low-privileged account to cross privilege boundaries. No active exploitation has been confirmed and no public exploit code has been identified; a vendor patch is available targeting build 16.0.20326.20090.
Remote code execution in Microsoft SharePoint Server Subscription Edition allows an authenticated low-privileged attacker to execute arbitrary code over the network by exploiting an improper access control flaw (CWE-284). The vulnerability affects build versions from 16.0.0 up to but not including 16.0.20326.20090, which Microsoft has patched. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Remote code execution in Microsoft SharePoint Server Subscription Edition allows any low-privileged authenticated user to execute arbitrary code on the server over the network via an improper access control flaw (CWE-284). The vulnerability carries a CVSS 8.8 with full C:H/I:H/A:H impact triad, meaning successful exploitation yields complete compromise of the SharePoint server. No confirmed active exploitation or public proof-of-concept is identified at time of analysis, but on-premises SharePoint deployments represent high-value enterprise targets warranting priority patching.
Remote code execution in Microsoft SharePoint Server Subscription Edition (below 16.0.20326.20090) allows a low-privileged authenticated attacker to execute arbitrary code over the network by exploiting improper access control. The flaw, rooted in CWE-284, permits an authorized user to exceed their intended permissions and trigger server-side code execution without any user interaction. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Privilege escalation via stored cross-site scripting in Microsoft SharePoint Server allows an authenticated low-privileged attacker to elevate their rights over a network by injecting malicious script that executes in a victim's browser session. Affected products include SharePoint Server 2019 and Subscription Edition with specific unpatched builds. No active exploitation has been confirmed - SSVC rates exploitation as none, EPSS stands at 0.42% (35th percentile), and the CVE is not listed in CISA KEV - though the CVSS-rated technical impact is classified as total due to high confidentiality and integrity compromise enabled by the scope change.
Privilege escalation via SSRF in Microsoft Office SharePoint exposes authenticated users to full system compromise - confidentiality, integrity, and availability all rated High. The CVSS vector (PR:L/AV:N/AC:L/UI:N) confirms that any authenticated SharePoint user can trigger the vulnerability over the network without additional complexity. No active exploitation or public exploit code has been identified at time of analysis, though the low attack complexity and broad privilege impact make this a credible near-term risk.
Server-side request forgery in Microsoft Office SharePoint enables low-privileged authenticated attackers to escalate privileges with no user interaction required, achieving high confidentiality, integrity, and availability impact. The flaw (CWE-918) allows a legitimate but low-privilege account holder to forge server-side HTTP requests, likely reaching internal administrative interfaces or credential endpoints inaccessible from the network perimeter. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution in Microsoft Office SharePoint allows an attacker authenticated with low privileges to execute arbitrary code over a network via unsafe deserialization of user-controlled data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms full confidentiality, integrity, and availability impact with no user interaction required. No public exploit code has been identified at time of analysis, and SharePoint is not currently listed in the CISA KEV catalog based on available data.
Cross-site scripting in Microsoft Office SharePoint lets a remote, unauthenticated attacker inject script that executes in a victim's browser session to conduct spoofing, provided the victim is lured into interacting with the malicious content. Microsoft rates it 9.3 (Critical) with a scope-changed vector, reflecting that injected script escapes into the victim's authenticated SharePoint context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Microsoft Office SharePoint exploits unsafe deserialization of attacker-controlled data over the network. An authenticated attacker with low-level network access can submit a crafted serialized payload that SharePoint deserializes without sufficient validation, resulting in full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, but the low attack complexity and high impact across all three security properties make this a critical remediation priority.
Remote code execution in Microsoft Office SharePoint enables any authenticated low-privileged user to execute arbitrary code on the server by submitting maliciously crafted serialized data over the network. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack requires no user interaction, low complexity, and only a standard SharePoint account - making this straightforward to weaponize within any organization whose SharePoint is network-accessible to internal users or external authenticated parties. No public exploit code or CISA KEV listing is identified at time of analysis, though SharePoint deserialization vulnerabilities have historically attracted rapid weaponization.
Remote code execution in Microsoft SharePoint Server allows a network-authenticated attacker with low-level privileges to execute arbitrary code by exploiting unsafe deserialization of attacker-controlled data. Both SharePoint Server 2019 and the Subscription Edition are confirmed affected, with patches available from Microsoft. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and full-triad impact (C:H/I:H/A:H) make this a high-priority patching target for enterprise environments.
Remote code execution in Microsoft SharePoint allows any authenticated, low-privileged network attacker to execute arbitrary code on the server by exploiting unsafe deserialization of attacker-controlled data (CWE-502). Three on-premises SharePoint Server product lines are confirmed affected - Enterprise Server 2016, Server 2019, and Server Subscription Edition - with fixed builds available from Microsoft. No public exploit code has been identified at time of analysis, but the low attack complexity and precedent of prior SharePoint deserialization CVEs being rapidly weaponized (e.g., CVE-2019-0604) make this a high-priority patching target for any organization running on-premises SharePoint.
Code injection (CWE-94) in Microsoft SharePoint Server exposes authenticated network users to high-impact compromise across confidentiality, integrity, and availability on unpatched servers running SharePoint 2016 Enterprise, 2019, or Subscription Edition. The CVSS 8.8 rating (AV:N/AC:L/PR:L) reflects network exploitation requiring only low-privileged credentials, though the CVE description characterizes the primary effect as spoofing rather than full remote code execution - a tension that deserves verification against the Microsoft MSRC advisory. No public exploit code and no CISA KEV listing have been identified at time of analysis, and SSVC rates exploitation as none and automatable as no, moderating the immediate response urgency.
Remote code execution in Microsoft SharePoint Server exposes organizations to full system compromise via deserialization of attacker-controlled data submitted over the network. Versions across three SharePoint Server editions (Subscription Edition, 2019, and Enterprise 2016) are confirmed affected, all requiring only a low-privileged authenticated account to exploit. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and high impact across confidentiality, integrity, and availability make this a critical-priority remediation item for any enterprise SharePoint deployment.
Privilege escalation in Microsoft SharePoint Server (2016 Enterprise, 2019, and Subscription Edition) allows a low-privileged authenticated attacker to gain elevated access over the network by invoking a critical internal function that lacks proper authentication enforcement. The flaw (CWE-306) is exploitable with low complexity and no user interaction, resulting in full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity against a widely-deployed enterprise platform makes this a priority patching target.
Remote code execution in Microsoft SharePoint Server allows any authenticated network attacker to execute arbitrary code by submitting a malicious serialized object payload to vulnerable endpoints. Three major SharePoint versions are affected - SharePoint Server 2016, 2019, and Subscription Edition - all running build versions below their respective patched thresholds. No public exploit code has been identified at time of analysis, but the low privilege requirement (any valid SharePoint account) and low attack complexity make this a high organizational priority, particularly given SharePoint's widespread enterprise deployment footprint.
Remote code execution in Microsoft SharePoint is achievable by unauthenticated network attackers exploiting improper input validation (CWE-20), with the 'Authentication Bypass' tag indicating the flaw may circumvent access controls entirely. Three active SharePoint product lines are confirmed affected - Enterprise Server 2016, Server 2019, and the Subscription Edition - across a defined version range for each. Vendor patches are available from Microsoft; no public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible, zero-privilege attack vector makes this a high-priority patching target.
Remote code execution in Microsoft SharePoint Server affects authenticated network users through unsafe deserialization of attacker-controlled data. Affected versions span SharePoint Server 2019, SharePoint Enterprise Server 2016, and SharePoint Server Subscription Edition - all running build numbers below the patched releases issued by Microsoft. An attacker with a valid low-privilege account can send a crafted payload over the network to trigger arbitrary code execution on the server without any user interaction, achieving full compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing is identified at time of analysis, but the low-complexity, network-reachable attack surface makes this a high-priority patching target.
Privilege escalation in Microsoft SharePoint allows an authenticated low-privilege attacker to elevate to higher permissions over a network, exploiting improper authentication logic (CWE-287). Three on-premises SharePoint versions are confirmed affected - Enterprise Server 2016, Server 2019, and the current Subscription Edition - with vendor-released patches available for all. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 score and full High C/I/A impact profile make this a serious priority for organizations running unpatched on-premises SharePoint.
Remote code execution in Microsoft Office SharePoint enables an authenticated attacker with low privileges to execute arbitrary code over the network when a victim user is induced to perform an action. The flaw stems from an improper authorization check (CWE-285) that fails to enforce expected access boundaries, yielding full confidentiality, integrity, and availability impact (CVSS 8.0). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Privilege escalation in Microsoft Office SharePoint allows an authenticated network attacker to elevate privileges by submitting maliciously crafted serialized data that the server deserializes without proper validation. The CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability combined with low attack complexity, though the PR:L requirement means the attacker must already hold at least a low-privileged SharePoint account. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Local code execution in Microsoft Office is possible through a heap-based buffer overflow (CWE-122) that an unauthenticated attacker can trigger when a user opens a crafted document. The CVSS 3.1 base score of 7.8 reflects high impact to confidentiality, integrity, and availability, with required user interaction limiting mass exploitation. There is no public exploit identified at time of analysis and the issue is not currently listed on the CISA KEV catalog.
Local code execution in Microsoft Office Word enables an attacker to run arbitrary code in the context of the current user by tricking them into opening a malicious document that triggers an untrusted pointer dereference. With a CVSS 7.8 score and no public exploit identified at time of analysis, the flaw is exploited locally but unauthenticated, relying on user interaction to open a crafted file. Microsoft has issued an advisory via the MSRC Security Update Guide.
Local code execution in Microsoft Office via a type confusion flaw (CWE-416) permits unauthorized attackers to run arbitrary code in the context of the Office process without requiring privileges or user interaction. The issue carries a high CVSS 3.1 score of 8.4 with full impact across confidentiality, integrity, and availability, though exploitation requires local attack vector access to the target system. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Local code execution in Microsoft Office stems from a type confusion (CWE-843) flaw that allows an unauthenticated attacker with local access to run arbitrary code in the context of the Office process. The CVSS 8.4 score reflects high impact on confidentiality, integrity, and availability without requiring privileges or user interaction, though the attack vector is local. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV.
Path traversal in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) enables an authenticated low-privileged attacker to execute code over a network by escaping the intended directory scope. Affected builds span all three actively maintained SharePoint Server product lines, with vendor-confirmed patches available for each. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog; however, the low attack complexity (AC:L) and no user interaction requirement (UI:N) make it a credible target for exploitation once an attacker has any valid SharePoint credential.
Local code execution in Microsoft Office is possible through a heap-based buffer overflow (CWE-122) that triggers when a user opens or previews a maliciously crafted document. The CVSS 7.8 score reflects local attack vector with required user interaction, and no public exploit identified at time of analysis. Successful exploitation yields full confidentiality, integrity, and availability impact in the context of the current user.
Local code execution in Microsoft Office is possible when a user opens a maliciously crafted document that triggers a heap-based buffer overflow (CWE-122), allowing the attacker to run arbitrary code in the context of the opened Office process. The CVSS 7.8 (AV:L/AC:L/PR:N/UI:R) reflects a user-interaction-driven local exploit rather than a remote network attack, and no public exploit identified at time of analysis. The flaw was reported through Microsoft Security Response Center (secure@microsoft.com) and is tracked in MSRC's update guide.
Remote code execution in Microsoft SharePoint Server through unsafe deserialization of untrusted data allows authenticated attackers to execute arbitrary code with high privileges over the network. The vulnerability requires valid user credentials but no user interaction, making it exploitable by any authorized account. No patch is currently available, leaving affected systems vulnerable until Microsoft releases a fix.
Unsafe pointer dereference in Microsoft Office, SharePoint Server, and 365 Apps enables local code execution with high privileges on affected systems. An attacker with local access can exploit this memory safety flaw to achieve complete system compromise including data theft and modification. No patch is currently available, leaving users vulnerable until Microsoft releases a security update.
Remote code execution in Microsoft SharePoint Server allows authenticated users to bypass input validation and execute arbitrary code across the network. This high-severity vulnerability (CVSS 8.8) affects authorized attackers who can leverage improper validation controls to achieve full system compromise. No patch is currently available, making immediate mitigation and access controls critical for affected organizations.
Microsoft SharePoint Server contains a reflected cross-site scripting vulnerability that allows remote attackers to execute arbitrary scripts in users' browsers through malicious links, enabling spoofing attacks and credential theft. The vulnerability requires user interaction to trigger and affects all SharePoint deployments with no available patch. With a CVSS score of 8.1, this poses a significant risk to organizations relying on SharePoint for collaboration.
Microsoft Outlook's unsafe deserialization of untrusted data enables remote attackers to spoof messages and identities without authentication over the network. This vulnerability affects Outlook, Word, and Microsoft 365 Apps, allowing attackers to impersonate legitimate senders and deceive users. No patch is currently available, making this a high-risk threat requiring immediate defensive measures.
Information disclosure in Microsoft Outlook, SharePoint Server, Office, and 365 Apps enables remote attackers to conduct email spoofing attacks without authentication or user interaction. The vulnerability affects multiple Microsoft collaboration products and could allow threat actors to impersonate legitimate senders to compromise organizational security. No patch is currently available for this high-severity issue.
Local code execution in Microsoft SharePoint Server results from inadequate input validation, enabling attackers with local access to execute arbitrary code with user interaction. The vulnerability affects SharePoint deployments and carries high impact across confidentiality, integrity, and authenticity. No patch is currently available.
Local code execution in Microsoft Office Word (including 365 Apps and SharePoint Server) results from unsafe pointer dereferencing that can be triggered by user interaction with a malicious document. An attacker with local access can exploit this vulnerability to execute arbitrary code with the privileges of the affected user. No patch is currently available for this vulnerability.
SQL injection in Microsoft SharePoint Server enables authenticated attackers to execute arbitrary code remotely through improper sanitization of database queries. This vulnerability affects authorized users with network access and could allow them to compromise affected systems with high-level privileges. No patch is currently available for this issue.
Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally. [CVSS 7.0 HIGH]
Microsoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over the network, with active exploitation confirmed and patches pending full release.
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated attackers to execute arbitrary code over the network. KEV-listed with EPSS 63.8%, this vulnerability requires only basic SharePoint authentication and enables server-level code execution, threatening the documents, workflows, and data stored across the organization's SharePoint infrastructure.
Microsoft SharePoint Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
Microsoft SharePoint Server Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Microsoft SharePoint Server Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Microsoft SharePoint Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework,. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Cross-site scripting (XSS) in Microsoft SharePoint Server 2019 allows remote attackers to inject malicious scripts into web pages viewed by other users, potentially leading to spoofing or limited data theft. Exploitation requires user interaction (e.g., clicking a crafted link) but no authentication, and it is not automatable. No public exploit code or active exploitation has been identified, and the overall risk is assessed as moderate due to the required victim interaction and limited impact.
Microsoft SharePoint Server Subscription Edition is affected by an observable-discrepancy weakness (CWE-203) that allows an authenticated, low-privileged user with network access to compare response content, timing, or error signals and use those differences to extract protected information and tamper with server-side data. Scope is limited to SharePoint Server Subscription Edition, and exploitation is not remote-unauthenticated: the attacker needs a valid account and must meet conditions outside their direct control (high attack complexity), so the issue is situational rather than mass-exploitable. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV not applicable; SSVC reports Exploitation: none, Automatable: no, Technical Impact: total), so the surrounding signals indicate limited real-world urgency for this moderate-severity issue.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition (16.0.0 prior to build 16.0.20326.20190) lets an attacker holding a valid, low-privileged SharePoint account inject content that is rendered in another user's browser, enabling spoofing and manipulation of page content. Exploitation requires the victim to view or interact with the attacker-controlled content, and impact is limited to low confidentiality and integrity with no availability effect, consistent with the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, score 4.6). There is no public exploit identified at time of analysis and CISA's SSVC assessment records no exploitation and no automatable attack path, making this a low-severity, low-priority issue; a vendor patch is available.
Stored cross-site scripting in Microsoft SharePoint Server Subscription Edition (16.0.0 builds prior to 16.0.20326.20190) allows an authenticated user who can author or edit content to inject script that later executes in the browser of a different user who views the affected page, resulting in spoofed page content. Exploitation requires a valid SharePoint account with content-editing rights and victim interaction, so it is neither unauthenticated nor zero-click; the assessed impact is limited to spoofing with low confidentiality and integrity consequences and no availability impact. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation, making this a low-priority, patch-on-normal-cycle issue rather than an emergency.
Path traversal in Microsoft SharePoint Server Subscription Edition allows an authenticated attacker to read files outside the intended content directory, resulting in disclosure of confidential information over the network. The flaw affects SharePoint Server Subscription Edition builds prior to 16.0.20326.20190 and carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), meaning exploitation requires valid low-privilege credentials, needs no user interaction, and cannot modify data or cause denial of service. CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis - the practical risk is concentrated on insiders or attackers holding stolen or low-privilege accounts rather than anonymous internet adversaries.
Path traversal (CWE-22) in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker read files outside an intended restricted directory over the network. Exploitation requires a valid low-privileged session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it is not an anonymous, internet-wide attack - the credential requirement is the primary limiting factor, and CISA's SSVC assessment rates it Exploitation: none, Automatable: no, Technical Impact: partial. Impact is confidentiality-only (no integrity or availability effect), and no public exploit code has been identified at time of analysis; Microsoft has released a vendor patch.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition lets an authenticated remote attacker with low privileges coerce the SharePoint server into making requests to destinations of the attacker's choosing, exposing information held on network-accessible resources that the server can reach (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Because the vector specifies PR:L, a valid low-privileged session on the affected build (16.0.0 before 16.0.20326.20190) is required and unauthenticated exploitation is not indicated; no user interaction is needed. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is a medium-priority, confidentiality-only issue whose urgency is driven by how widely low-privileged accounts are granted and whether the farm is internet-exposed.
Information disclosure in Microsoft SharePoint Server Subscription Edition lets an already highly privileged, authenticated attacker read confidential data over the network from an affected farm. Exploitation requires PR:H per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), so the practical exposure is limited to privileged insiders or adversaries who have already taken over a high-privilege account; there is no integrity or availability impact. The flaw carries a CVSS base score of 4.9 and, per CISA SSVC, exploitation has not been observed and the issue is not automatable; no public exploit code was identified at time of analysis. Microsoft has published a vendor fix, making this a medium-priority patching item rather than an emergency.
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated, low-privileged user to perform actions beyond their granted permissions over the network (CVSS 4.3, CWE-863) on builds below 16.0.20326.20190. Exploitation is constrained by the mandatory pre-existing valid account on the farm, and the impact is limited to a low integrity effect with no confidentiality or availability loss and no scope change. No public exploit code exists and the issue is not confirmed as actively exploited (CISA KEV); this is a moderate, vendor-patchable elevation-of-privilege issue rather than an emergency.
Improper input validation in Microsoft SharePoint Server Subscription Edition (versions 16.0.0 prior to 16.0.20326.20190) allows an attacker holding a valid low-privilege authenticated session to disclose confidential information over the network, with a CVSS 3.1 base score of 6.5. Because the vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the weakness is remotely reachable and trivially triggered once a session exists, but it cannot be exploited by a fully unauthenticated attacker and produces no integrity or availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a moderate-priority patch-and-monitor item rather than an emergency, though the high confidentiality rating means successful abuse could expose content the attacker is not entitled to read, and the affected server must be network-accessible to the attacker for exploitation.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authenticated attacker who can reach the server from an adjacent network segment make the SharePoint front end issue requests on their behalf, exposing internal services and data (CVSS 5.7, AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, confidentiality-only impact). Low-privilege credentials and adjacency are both mandatory preconditions, so unauthenticated internet-based attackers are excluded, and no user interaction or race conditions are involved. A vendor patch is available, no public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported, making this a patch-management priority rather than an emergency.
Incorrect authorization in Microsoft SharePoint Server Subscription Edition (versions below 16.0.20326.20190) allows an authenticated attacker with low privileges to disclose information over the network, with no user interaction required. The flaw is rooted in CWE-863 (Incorrect Authorization), meaning the server fails to properly validate whether a user is entitled to access certain data. No public exploit code or confirmed active exploitation is identified at time of analysis for CVE-2026-102865; the limiting factor is that the attacker must already hold valid low-privilege access, so realistic risk is highest in environments with many authenticated users or multi-tenant/shared SharePoint sites where cross-account disclosure matters.
Cross-site scripting (spoofing) in Microsoft SharePoint Server Subscription Edition lets an authenticated, authorized user submit crafted content that SharePoint renders without proper neutralization, causing attacker-controlled script to execute in a victim's browser session when that victim views the content. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) shows the two gating factors are valid authentication to the SharePoint instance and required victim interaction, with impact confined to low confidentiality and low integrity and no availability effect. The issue carries a CVSS base score of 4.6 and affects Subscription Edition builds before 16.0.20326.20190; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition, affecting builds before 16.0.20326.20190, allows an authenticated attacker with permission to insert content into a page rendered to other users to spoof page content or run script in a victim's browser once the victim views or interacts with the affected page. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, reflecting low confidentiality and integrity impact and a requirement for prior authentication plus victim interaction. No public exploit was identified at time of analysis, and the vendor has released a patch.
Server-side request forgery (SSRF) in Microsoft SharePoint Server Subscription Edition enables a low-privileged authenticated attacker to cause the server to issue outbound network requests, resulting in limited information disclosure. Exploitation requires user interaction in addition to a valid low-level account, constraining real-world impact to authenticated insider or phishing-assisted scenarios. No public exploit code has been identified, and the vulnerability carries a low CVSS base score of 3.5, reflecting its narrow confidentiality-only impact.