Microsoft SharePoint Server: Elevation of privilege via incorrect authorization
Summary
Incorrect authorization in Microsoft Office SharePoint Server Subscription Edition allows an authenticated attacker to elevate privileges over the network. The CVSS base score is 8.8 (High), and the CVSS vector indicates high impact on confidentiality, integrity and availability. An attacker needs a valid user account with low privileges; no user interaction is required. A compromised SharePoint server can serve as a pivot point into internal systems.
Affected
- Microsoft SharePoint Server Subscription Edition: 16.0.0 to before 16.0.20326.20190
- SharePoint Server 2019 and 2016: Unknown.
Fixed in
- Microsoft SharePoint Server Subscription Edition: build 16.0.20326.20190 (October 13, 2026 security update)
- Note: the CVE was omitted from the October 2026 Patch Tuesday listing, but the fix is included in the released update.
- SharePoint Server 2019 and 2016: Unknown.
Workaround
- Unknown. No Microsoft-published workaround is known. Patching is the primary action.
Exploitation
- Exploited in the wild: no evidence found. CISA SSVC: exploitation none, automatable no. Not in the CISA KEV catalog.
- Public proof-of-concept: none found.
- A separate SharePoint campaign in July 2026 exploited other SharePoint CVEs; this CVE is not directly linked to it.
Our recommendation
- Identify all SharePoint Server farms, their editions and build numbers.
- Install the October 2026 update (build 16.0.20326.20190 or later) on Subscription Edition farms; handle SharePoint Workflow Manager prerequisites first if applicable.
- Confirm the status of SharePoint 2019 and 2016 directly with Microsoft before assuming they are unaffected.
- Review user accounts, external sharing and recent privilege changes on the farm.
- Prioritise internet-facing servers.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Microsoft Office SharePoint
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Microsoft Office
- Updates (KB)
- KB5002927
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC advisory CVE-2026-70246 msrc.microsoft.com
- Microsoft KB5002927 support.microsoft.com
- NVD record via OpenCVE app.opencve.io
- Senserva KB 5002927 senserva.com
- Stefan Gossner October 2026 SharePoint fixes blog.stefan-gossner.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:52.
Original description (NVD)
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.