Microsoft SharePoint Server: Remote code execution vulnerability
Summary
A flaw in Microsoft Office SharePoint Server Subscription Edition allows the inclusion of functionality from an untrusted control sphere (CWE-829). An authenticated attacker on the network can execute code on the server, with high impact on confidentiality, integrity and availability. According to the CVSS vector, the attacker needs high privileges and no user interaction is required. Microsoft has released a fix in the October 13, 2026 update.
Affected
- Microsoft SharePoint Server Subscription Edition: version 16.0.0 up to but not including 16.0.20326.20190
- SharePoint Server 2016 and 2019: unknown, not stated in the sources reviewed
Fixed in
- Microsoft SharePoint Server Subscription Edition build 16.0.20326.20190 or later, included in the October 13, 2026 update (KB5002927)
- Prerequisite: the release version of SharePoint Server Subscription Edition must be installed. Update Workflow Manager first if it is in use.
Workaround
Unknown. No vendor-specific workaround was found in the sources reviewed.
Exploitation
- Not listed in the CISA KEV catalog.
- CISA SSVC data: exploitation none, not automatable, total technical impact.
- No public proof-of-concept code found. This does not rule out that exploit code exists.
- Other SharePoint CVEs were actively exploited in July 2026, but these are not CVE-2026-70267.
Our recommendation
- Check whether SharePoint Server Subscription Edition is in use and whether it is reachable from the internet or an extranet.
- Install the October 13, 2026 update (KB5002927) as part of the regular patch cycle, including Workflow Manager if used.
- Verify the installed build is 16.0.20326.20190 or later.
- Review administrator accounts and restrict high-privilege access, since the attack requires high privileges.
- Monitor SharePoint servers for unusual code execution or administrative activity.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Microsoft Office SharePoint
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Microsoft Office
- Updates (KB)
- KB5002927
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-70267 msrc.microsoft.com
- Microsoft KB5002927: SharePoint update support.microsoft.com
- OpenCVE: CVE-2026-70267 app.opencve.io
- Vulners CVE record: CVE-2026-70267 vulners.com
- Senserva: KB5002927 overview senserva.com
- Zero Day Initiative: October 2026 Security Update Review www.zerodayinitiative.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 05:17.
Original description (NVD)
Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.