Microsoft SharePoint Server: Remote code execution through integer overflow

Summary

An integer overflow or wraparound in Microsoft Office SharePoint Server allows remote code execution over the network. Microsoft rates the flaw Important with a CVSS score of 8.8. According to Microsoft, an attacker needs an authenticated account with Manage List permission, so anonymous internet attackers should not reach it directly. Risk increases where SharePoint is internet-facing, self-registration is enabled, credentials are weak or reused, or accounts with list rights are compromised.

Affected

• Microsoft SharePoint Server Subscription Edition: 16.0.0 to before 16.0.20326.20190
• SharePoint Server 2016 and SharePoint Enterprise Server 2016: Unknown (check the MSRC advisory)
• SharePoint Server 2019: Unknown (check the MSRC advisory)
• Microsoft 365 / SharePoint Online: not in scope

Fixed in

• Subscription Edition: build 16.0.20326.20190 or later, delivered with KB5002927 (released October 13, 2026)
• SharePoint Server 2016 and 2019: Unknown; the MSRC advisory states a fix exists for 2016 but the KB number could not be confirmed

Workaround

• No vendor workaround known. Microsoft names patching as the remedy.
• Generic, non-vendor measures: restrict network access to trusted IP ranges and enforce strong authentication.

Exploitation

• No evidence of in-the-wild exploitation.
• Not listed in the CISA KEV catalog.
• CISA SSVC data: exploitation none, automatable no, technical impact total.
• Microsoft exploit code maturity: Unproven.
• EPSS: 2.0 percent (third-party data).
• No public proof of concept found; this is absence of evidence, not confirmation.

Our recommendation

• Patch on-premises Subscription Edition farms to build 16.0.20326.20190 or later (KB5002927).
• Confirm the fix for SharePoint 2016 and 2019 on the MSRC page and apply it.
• Prioritise internet-facing farms and farms with many users holding list rights.
• Review who holds Manage List permissions and remove unnecessary rights.
• Disable self-registration where not needed and enforce strong, unique passwords and multi-factor authentication.
• Monitor SharePoint logs for unusual list or content changes and unexpected code execution on servers.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88166 msrc.microsoft.com
• Microsoft Support: SharePoint hotfix KB5002927 support.microsoft.com
• Stefan Gossner: SharePoint security fixes released with October 2026 PU blog.stefan-gossner.com
• Zero Day Initiative: The October 2026 Security Update Review www.zerodayinitiative.com
• Senserva: KB5002927 details senserva.com
• OpenCVE: CVE-2026-88166 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:04.