Path traversal in Microsoft SharePoint Server - CVE-2026-69943
Published: October 13, 2026
Vulnerability identifier: #VU154455
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-69943
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code on the server.
The vulnerability exists due to path traversal in Microsoft SharePoint Server when handling requests. A remote user can send a specially crafted request to execute arbitrary code on the server.
User interaction is not required. The Preview Pane is not an attack vector.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-69943
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20190