Missing Authorization in Microsoft SharePoint Server - CVE-2026-88176

Vulnerability details

The vulnerability allows a remote user to escalate privileges and access or modify SharePoint data in the security context of another user.

The vulnerability exists due to missing authorization in Microsoft Office SharePoint when handling page content. A remote user can store malicious script in a page they have permission to add or modify to execute script in another user's security context and perform actions permitted to that user.

Affected software

How to mitigate CVE-2026-88176

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88176
• https://support.microsoft.com/help/5002927

Related Security Bulletins

• Multiple vulnerabilities in Microsoft SharePoint Server