Improper access control in Microsoft SharePoint Server - CVE-2026-102860
Published: October 13, 2026
Vulnerability identifier: #VU154294
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102860
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges and inject arbitrary code into the server.
The vulnerability exists due to improper access control in Microsoft Office SharePoint when accessing the service over a network. A remote user can gain Site Owner permissions to escalate privileges and inject arbitrary code into the server.
Default configurations enable this privilege escalation. The Preview Pane is not an attack vector.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-102860
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20190