Microsoft SharePoint Server: Remote code execution via integer overflow
Summary
A integer overflow or wraparound flaw in Microsoft SharePoint Server Subscription Edition allows an attacker with valid credentials to execute code over the network. The CNA record and the research notes describe the attack as requiring authentication, and the required permission (list management) is reported differently by the sources. Exploitation is not known at the time of writing and the flaw is not listed in CISA KEV.
Affected
- Microsoft SharePoint Server Subscription Edition: versions 16.0.0 to below 16.0.20326.20190
- SharePoint Server 2016/2019: unknown
Fixed in
- Microsoft SharePoint Server Subscription Edition: build 16.0.20326.20190 or later (October 2026 security update, KB5002927)
- Mapping of CVE-2026-88163 to KB5002927 not yet confirmed on the MSRC page
Workaround
Unknown. No vendor workaround found; patching is the only fix in the reviewed sources.
Exploitation
- No public proof of concept found
- Not listed in CISA KEV
- CISA SSVC in the CNA record: exploitation none, automatable no, technical impact total
- EPSS about 0.008 at time of capture (may have changed)
Our recommendation
- Install the October 2026 security update (KB5002927) on SharePoint Server Subscription Edition as soon as possible
- If the farm is at the September 2025 CU level, run the documented folder permission script before installing, otherwise the installation fails
- Check whether the farm is reachable from the internet and restrict access to it
- Review accounts with list management rights and remove unneeded permissions
- Monitor for unusual activity and re-check KEV and PoC status before closing the ticket
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Microsoft Office SharePoint
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Microsoft Office
- Updates (KB)
- KB5002927
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide msrc.microsoft.com
- Microsoft KB5002927 SharePoint hotfix support.microsoft.com
- Stefan Goßner blog: SharePoint security fixes October 2026 blog.stefan-gossner.com
- Zero Day Initiative: October 2026 security update review www.zerodayinitiative.com
- OpenCVE CVE-2026-88163 app.opencve.io
- Vulners VulnRichment CVE-2026-88163 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:05.
Original description (NVD)
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.