Missing Authorization in Microsoft SharePoint Server - CVE-2026-102861
Published: October 13, 2026
Vulnerability identifier: #VU154295
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102861
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges and perform actions permitted to an affected SharePoint user.
The vulnerability exists due to missing authorization in Microsoft Office SharePoint when accessing the software over a network. A remote user can run script in the security context of an affected SharePoint user to escalate privileges and perform actions permitted to that user.
The Preview Pane is not an attack vector for this vulnerability.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-102861
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20190