Server-Side Request Forgery (SSRF) in Microsoft SharePoint Server - CVE-2026-112736
Published: November 11, 2026
Vulnerability identifier: #VU164830
CSH Severity: Low
CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-112736
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform server-side request spoofing and potentially disclose sensitive information.
The vulnerability exists due to server-side request forgery in Microsoft SharePoint Server when handling requests influenced by user input. A remote user can induce the server to send requests to unintended destinations to potentially disclose sensitive information.
The Preview Pane is not an attack vector for this vulnerability.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-112736
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20278