Microsoft SharePoint Server: Missing authorization leads to privilege escalation
Summary
Missing authorization checks in Microsoft Office SharePoint allow an authenticated attacker with a low-privileged account to perform operations beyond the permissions granted to that account. The attacker needs network access to an affected server and a valid user account, and the vulnerability is rated High (CVSS 3.1 8.8). Internet-facing farms with many user, external or guest accounts are more exposed.
Affected
- SharePoint Server Subscription Edition: the official CVE record lists 16.0.0 to below 16.0.20326.20190. The exact build number was not confirmed on Microsoft's pages, so check the MSRC entry before making patch decisions.
- SharePoint Server 2016 and 2019: Unknown.
Fixed in
- SharePoint Server Subscription Edition: October 2026 update, KB5002927.
- Microsoft states the fix is in place even though the CVE was omitted from the October 2026 security update list.
Workaround
Unknown. No workaround was found in the sources. Installing KB5002927 is the mitigation.
Exploitation
- Not listed in the CISA KEV catalog.
- CISA SSVC data lists exploitation as none and automatable as no.
- EPSS is 2.0% (third-party data).
- No public proof-of-concept exploit was found in searches. This is not proof that none exists.
Our recommendation
- Check your SharePoint version and farm patch level against the MSRC entry and KB5002927. Do not rely on third-party version ranges.
- Before patching a September 2025 CU farm, run the folder permission prerequisite check described in the Stefan Gossner blog, otherwise the SharePoint fixes may fail.
- Install the October 2026 update on affected Subscription Edition farms.
- Review accounts with external or guest access and any internet exposure of the farm.
- Recheck KEV and public PoC status before the next review cycle.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Microsoft Office SharePoint
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Microsoft Office
- Updates (KB)
- KB5002927
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center: CVE-2026-88198 msrc.microsoft.com
- Microsoft Support: SharePoint update KB5002927 support.microsoft.com
- Stefan Gossner: SharePoint security fixes October 2026 blog.stefan-gossner.com
- OpenCVE: CVE-2026-88198 app.opencve.io
- Senserva: KB5002927 details senserva.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:01.
Original description (NVD)
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.