Main Vulnerability Database Vulnerabilities #VU147907

SQL injection in Microsoft SharePoint Server - CVE-2026-69716

Published: September 8, 2026

Vulnerability identifier: #VU147907

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-69716

CWE-ID: CWE-89

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to elevate privileges.

The vulnerability exists due to improper neutralization of special elements used in an SQL command in Microsoft Office SharePoint when handling requests to an affected service. A remote user can send a specially crafted request to execute database commands with elevated privileges to elevate privileges.

Affected software

Microsoft SharePoint Server

How to mitigate CVE-2026-69716

Install security update from vendor's website.

Microsoft SharePoint Server - update to 16.0.20326.20094

External References

Related Security Bulletins