SB2026110528 - Multiple vulnerabilities in Microsoft SharePoint Server

Description

This security bulletin contains information about 2 vulnerabilities.

1) Path traversal (CVE-ID: CVE-2026-108452)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code on the SharePoint Server.

The vulnerability exists due to path traversal in Microsoft Office SharePoint when handling network requests. A remote user can exploit insufficient pathname restrictions as a Site Owner to execute arbitrary code on the SharePoint Server.

2) Missing Authorization (CVE-ID: CVE-2026-88176)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to escalate privileges and access or modify SharePoint data in the security context of another user.

The vulnerability exists due to missing authorization in Microsoft Office SharePoint when handling page content. A remote user can store malicious script in a page they have permission to add or modify to execute script in another user's security context and perform actions permitted to that user.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108452
• https://support.microsoft.com/help/5002927
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88176