Inclusion of Functionality from Untrusted Control Sphere in Microsoft SharePoint Server - CVE-2026-70267
Published: October 14, 2026
Vulnerability identifier: #VU154692
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-70267
CWE-ID: CWE-829
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to execute arbitrary code.
The vulnerability exists due to inclusion of functionality from an untrusted control sphere in Microsoft Office SharePoint when handling network interactions. A remote privileged user can cause the inclusion of untrusted functionality to execute arbitrary code.
The Preview Pane is not an attack vector.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-70267
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20190