Incorrect authorization in Microsoft SharePoint Server - CVE-2026-102862
Published: October 13, 2026
Vulnerability identifier: #VU154296
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102862
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to incorrect authorization in Microsoft Office SharePoint when handling access over a network. A remote user can exploit the authorization flaw over a network to escalate privileges.
Under default configurations, exploitation grants Site Owner permissions, which allow arbitrary code injection into the server. The Preview Pane is not an attack vector.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-102862
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20190