Privilege Context Switching Error in Microsoft SharePoint Server - CVE-2026-88200
Published: October 14, 2026
Vulnerability identifier: #VU155390
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-88200
CWE-ID: CWE-270
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges and overwrite arbitrary file content in the security context of the local system.
The vulnerability exists due to a privilege context switching error in Microsoft Office SharePoint when handling specially crafted requests. A remote user can send a specially crafted request to perform an operation beyond their account permissions to escalate privileges and overwrite arbitrary file content in the security context of the local system.
No additional user interaction is required. The Preview Pane is not an attack vector.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-88200
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20190