Input validation error in Microsoft SharePoint Server - CVE-2026-105719
Published: October 13, 2026
Vulnerability identifier: #VU154345
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-105719
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive server configuration information.
The vulnerability exists due to improper input validation in Microsoft SharePoint Server when processing user-supplied input. A remote user can read application settings and connection strings to disclose sensitive server configuration information.
Exploitation requires permissions to create and customize pages. The Preview Pane is not an attack vector.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-105719
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20190