Improper access control in Microsoft SharePoint Server - CVE-2026-70217
Published: October 14, 2026
Vulnerability identifier: #VU154650
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-70217
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to disclose sensitive information.
The vulnerability exists due to improper access control in Microsoft Office SharePoint when accessing database information over a network. A remote privileged user can access normally restricted SQL table columns to disclose sensitive information.
The Preview Pane is not an attack vector for this vulnerability.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-70217
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20190