Microsoft SharePoint Server: Path traversal leading to remote code execution
Summary
Microsoft SharePoint Server contains a path traversal vulnerability (CWE-22) that allows an authorized attacker to execute code over the network. The official record lists Subscription Edition with versions from 16.0.0 to before 16.0.20326.20190, and the attacker needs a low-privilege account. Successful exploitation could lead to full compromise of the SharePoint host and its data.
Affected
- Microsoft SharePoint Server Subscription Edition: 16.0.0 to before 16.0.20326.20190 (official CNA record)
- Other SharePoint Server releases (2016, 2019, 2022): Unknown. Sources conflict; check the MSRC product table.
Fixed in
- Microsoft SharePoint Server Subscription Edition: 16.0.20326.20190 (secondary sources; KB5002927 per 365fanatic, not confirmed on MSRC)
- Other releases: Unknown.
Workaround
- Patching is the primary remediation. Workarounds are only needed for systems that cannot be patched yet.
- Temporarily restrict external access to SharePoint.
- Review accounts with upload or write rights and limit write permissions to the intended directories.
- Unofficial stopgap suggested by a third-party aggregator: reject uploads containing path traversal sequences. Not a Microsoft mitigation; not verified.
Exploitation
- Not listed in the CISA KEV catalog; no evidence of in-the-wild exploitation found.
- No public proof-of-concept exploit confirmed at this time.
- EPSS score: Unknown.
- CISA SSVC (ADP, via OpenCVE): exploitation none, automatable no.
Our recommendation
- Check the MSRC advisory to confirm affected SharePoint releases and fixed builds.
- Inventory all on-premises SharePoint servers, their build numbers and whether they are reachable from the internet.
- Apply the October 2026 security update or the vendor-listed fix for Subscription Edition (16.0.20326.20190 or later) as soon as it is confirmed for your release.
- Until patched, restrict external access and review accounts with upload or write rights.
- Monitor for KEV listings and public exploit releases, and re-check the EPSS score once available.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Microsoft Office SharePoint
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation unlikely
- Product family
- Microsoft Office
- Updates (KB)
- KB5002927
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-108452 msrc.microsoft.com
- 365fanatic: CVE-2026-108452 security advisory www.365fanatic.com
- OpenCVE: CVE-2026-108452 app.opencve.io
- VulDB: CVE-2026-108452 vuldb.com
- Strix AI: CVE-2026-108452 www.strix.ai
- TheHackerWire: CVE-2026-108452 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:18.
Original description (NVD)
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.