Path traversal in Microsoft SharePoint Server - CVE-2026-85932
Published: October 14, 2026
Vulnerability identifier: #VU155246
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85932
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to path traversal in Microsoft Office SharePoint when handling pathnames. A remote user can read files outside the restricted directory to disclose sensitive information.
The Preview Pane is not an attack vector for this vulnerability.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-85932
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20190