Main Vulnerability Database Vulnerabilities #VU123812

Input validation error in Microsoft products - CVE-2026-26106

Published: March 11, 2026

Vulnerability identifier: #VU123812

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-26106

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Microsoft SharePoint Server. A remote user can pass specially crafted input to the application and execute arbitrary code on the target system.

Affected software

Microsoft SharePoint Enterprise Server
Microsoft SharePoint Server
Microsoft SharePoint Server Subscription Edition

How to mitigate CVE-2026-26106

Install updates from vendor's website.

Microsoft SharePoint Enterprise Server - update to 16.0.5543.1000
Microsoft SharePoint Server - update to 16.0.10417.20102
Microsoft SharePoint Server Subscription Edition - update to 16.0.19725.20076

External References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26106

Related Security Bulletins