Server-Side Request Forgery (SSRF) in Microsoft SharePoint Server - CVE-2026-111296
Published: November 11, 2026
Vulnerability identifier: #VU164794
CSH Severity: Medium
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-111296
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to elevate privileges.
The vulnerability exists due to server-side request forgery in Microsoft Office SharePoint when processing user-controlled input used to initiate server-side requests. A remote user can submit crafted input that, with user interaction, causes the server to issue unintended requests to elevate privileges.
The Preview Pane is not an attack vector for this vulnerability.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-111296
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20278