Code Injection in Microsoft SharePoint Server - CVE-2026-102863
Published: October 13, 2026
Vulnerability identifier: #VU154297
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102863
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper control of code generation (code injection) in Microsoft Office SharePoint when handling requests. A remote user can send a specially crafted request to perform an operation beyond their account permissions to escalate privileges.
No additional user interaction is required. The Preview Pane is not an attack vector.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-102863
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20190