Main Vulnerability Database Vulnerabilities #VU121420

Server-Side Request Forgery (SSRF) in Microsoft products - CVE-2026-20958

Published: January 14, 2026

Vulnerability identifier: #VU121420

CSH Severity: Medium

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-20958

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in Microsoft SharePoint. A remote user can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Affected software

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Enterprise Server
Microsoft SharePoint Server

How to mitigate CVE-2026-20958

Install updates from vendor's website.

External References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20958

Related Security Bulletins