SB2026101404 - Multiple vulnerabilities in Microsoft SharePoint Server
Published: October 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 21 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2026-105719)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive server configuration information.
The vulnerability exists due to improper input validation in Microsoft SharePoint Server when processing user-supplied input. A remote user can read application settings and connection strings to disclose sensitive server configuration information.
Exploitation requires permissions to create and customize pages. The Preview Pane is not an attack vector.
2) Path traversal (CVE-ID: CVE-2026-70298)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to path traversal in Microsoft Office SharePoint when accessing the file system over a network. A remote user can read files outside the restricted directory to disclose sensitive information.
The Preview Pane is not an attack vector for this vulnerability.
3) Inclusion of Functionality from Untrusted Control Sphere (CVE-ID: CVE-2026-70267)
CWE-ID: CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to execute arbitrary code.
The vulnerability exists due to inclusion of functionality from an untrusted control sphere in Microsoft Office SharePoint when handling network interactions. A remote privileged user can cause the inclusion of untrusted functionality to execute arbitrary code.
The Preview Pane is not an attack vector.
4) SQL injection (CVE-ID: CVE-2026-70266)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper neutralization of special elements used in SQL commands in Microsoft Office SharePoint when processing SQL commands. A remote user can inject special elements into SQL commands to escalate privileges.
The Preview Pane is not an attack vector.
5) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-70259)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to server-side request forgery in Microsoft Office SharePoint when handling network requests. A remote user can exploit the server-side request forgery to disclose sensitive information.
The disclosed information might include a user's full trust token. The Preview Pane is not an attack vector.
6) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-70251)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to server-side request forgery in Microsoft Office SharePoint when handling requests over a network. A remote user can induce server-side requests to escalate privileges.
Successful exploitation requires specific conditions, such as particular protocol settings or configurations. The Preview Pane is not an attack vector.
7) Incorrect authorization (CVE-ID: CVE-2026-70246)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to gain SYSTEM privileges.
The vulnerability exists due to incorrect authorization in Microsoft SharePoint Server when accessing the server over a network. A remote user can execute code remotely on the SharePoint server to gain SYSTEM privileges.
Exploitation requires access to the domain.
8) Improper access control (CVE-ID: CVE-2026-70217)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to disclose sensitive information.
The vulnerability exists due to improper access control in Microsoft Office SharePoint when accessing database information over a network. A remote privileged user can access normally restricted SQL table columns to disclose sensitive information.
The Preview Pane is not an attack vector for this vulnerability.
9) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-70202)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to server-side request forgery in Microsoft Office SharePoint when handling network requests. A remote user can exploit the server-side request forgery over a network to escalate privileges.
Successful exploitation requires specific conditions, such as particular protocol settings or configurations.
10) Path traversal (CVE-ID: CVE-2026-69943)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the server.
The vulnerability exists due to path traversal in Microsoft SharePoint Server when handling requests. A remote user can send a specially crafted request to execute arbitrary code on the server.
User interaction is not required. The Preview Pane is not an attack vector.
11) Incorrect authorization (CVE-ID: CVE-2026-105720)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to incorrect authorization in the Microsoft SharePoint Holds list when scheduling hold-processing operations. A remote user can schedule hold-processing operations normally restricted to users who manage holds to escalate privileges.
Exploitation requires read-only access to the SharePoint Holds list.
12) Cross-site scripting (CVE-ID: CVE-2026-102859)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to perform spoofing.
The vulnerability exists due to improper neutralization of input in the web page generation functionality of Microsoft SharePoint Server when generating web pages. A remote user can exploit cross-site scripting over the network to perform spoofing.
Exploitation requires user interaction. The Preview Pane is not an attack vector.
13) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-105713)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose a user's NTLMv2 hash.
The vulnerability exists due to server-side request forgery in Microsoft Office SharePoint when performing server-side requests. A remote user can exploit this request forgery over an adjacent network to disclose a user's NTLMv2 hash.
The Preview Pane is not an attack vector.
14) Deserialization of Untrusted Data (CVE-ID: CVE-2026-105013)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to deserialization of untrusted data in Microsoft Office SharePoint when processing serialized data. A remote user can provide untrusted serialized data over a network to execute arbitrary code.
15) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-102866)
CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to escalate privileges.
The vulnerability exists due to improper verification of cryptographic signatures in Microsoft Office SharePoint when verifying proof tokens. A remote attacker can obtain a valid proof token for a targeted user, modify it, and submit it to an affected SharePoint server to escalate privileges.
Successful exploitation requires specific protocol settings or configurations to be in place. User interaction is not required.
16) Incorrect authorization (CVE-ID: CVE-2026-102865)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose file content.
The vulnerability exists due to incorrect authorization in Microsoft Office SharePoint when accessing files over a network. A remote user can exploit incorrect authorization to disclose file content.
The Preview Pane is not an attack vector for this vulnerability.
17) Cross-site scripting (CVE-ID: CVE-2026-102864)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to perform spoofing.
The vulnerability exists due to improper neutralization of input during web page generation in Microsoft Office SharePoint when generating web pages from supplied input. A remote user can supply input that triggers cross-site scripting to perform spoofing.
Exploitation requires user interaction. The Preview Pane is not an attack vector.
18) Code Injection (CVE-ID: CVE-2026-102863)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper control of code generation (code injection) in Microsoft Office SharePoint when handling requests. A remote user can send a specially crafted request to perform an operation beyond their account permissions to escalate privileges.
No additional user interaction is required. The Preview Pane is not an attack vector.
19) Incorrect authorization (CVE-ID: CVE-2026-102862)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to incorrect authorization in Microsoft Office SharePoint when handling access over a network. A remote user can exploit the authorization flaw over a network to escalate privileges.
Under default configurations, exploitation grants Site Owner permissions, which allow arbitrary code injection into the server. The Preview Pane is not an attack vector.
20) Missing Authorization (CVE-ID: CVE-2026-102861)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges and perform actions permitted to an affected SharePoint user.
The vulnerability exists due to missing authorization in Microsoft Office SharePoint when accessing the software over a network. A remote user can run script in the security context of an affected SharePoint user to escalate privileges and perform actions permitted to that user.
The Preview Pane is not an attack vector for this vulnerability.
21) Improper access control (CVE-ID: CVE-2026-102860)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges and inject arbitrary code into the server.
The vulnerability exists due to improper access control in Microsoft Office SharePoint when accessing the service over a network. A remote user can gain Site Owner permissions to escalate privileges and inject arbitrary code into the server.
Default configurations enable this privilege escalation. The Preview Pane is not an attack vector.
Remediation
Install update from vendor's website.
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105719
- https://support.microsoft.com/help/5002927
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70298
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70267
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70266
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70259
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70251
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70246
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70217
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70202
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-69943
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105720
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102859
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105713
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105013
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102866
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102865
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102864
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102863
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102862
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102861
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102860