Server-Side Request Forgery (SSRF) in Microsoft SharePoint Server - CVE-2026-88206
Published: October 14, 2026
Vulnerability identifier: #VU155395
CSH Severity: Low
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-88206
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges to SYSTEM.
The vulnerability exists due to server-side request forgery in Microsoft Office SharePoint when handling network requests. A remote user can trigger server-side requests to escalate privileges to SYSTEM.
Successful exploitation requires specific conditions, such as particular protocol settings or configurations. The Preview Pane is not an attack vector.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-88206
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20190