Microsoft SharePoint Server: Information disclosure via incorrect authorization
Summary
Incorrect authorization in Microsoft SharePoint Server Subscription Edition allows an authorized attacker to read information they should not see. The attack can be carried out over the network and requires a valid low-privilege account, but no user interaction. The impact is limited to confidentiality.
Affected
- Microsoft SharePoint Server Subscription Edition (on-premises, x64)
- Builds from 16.0.0 up to, but not including, 16.0.20326.20190
- SharePoint Server 2019 is not affected by the KB5002927 fix (per vendor blog)
Fixed in
- Security update KB5002927 (build 16.0.20326.20190 or later), October 2026
- This update supersedes security update KB5002908
Workaround
- Unknown. No vendor workaround was found; patching is the remedy.
Exploitation
- CISA SSVC: exploitation none, not automatable, technical impact partial
- No evidence of in-the-wild exploitation found; not listed in KEV (snapshot may be dated)
- No public proof-of-concept found
- EPSS approx. 0.009 (one mirror)
Our recommendation
- Install KB5002927 (build 16.0.20326.20190 or later) as soon as possible.
- Before rollout, check the KB for prerequisites; one third-party analysis reports that farms running Workflow Manager must first install KB5002799 (not verified).
- Test workflows after installing the October 2026 CU, as one user reports workflows failing to start.
- If patching is delayed, restrict external access to SharePoint and review guest and external accounts.
- Monitor access logs for unusual reads of sensitive content.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Information disclosure – Microsoft Office SharePoint
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Microsoft Office
- Updates (KB)
- KB5002927
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-102865 msrc.microsoft.com
- Microsoft KB5002927 (SharePoint Subscription Edition security update) support.microsoft.com
- Stefan Gossner: SharePoint security fixes released with October 2026 PU blog.stefan-gossner.com
- Stefan Gossner: October 2026 CU for SharePoint Server Subscription Edition blog.stefan-gossner.com
- NVD record via Vulners: CVE-2026-102865 vulners.com
- Windowsforum: CVE-2026-102865 write-up windowsforum.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 5 Nov 2026, 11:33.
Original description (NVD)
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.