Microsoft SharePoint Server: Elevation of privilege

Summary

Microsoft SharePoint Server Subscription Edition contains an elevation of privilege vulnerability (CWE-269, Improper Privilege Management). An attacker with a low-privileged valid account can reach a higher privilege level, potentially gaining administrative control over the affected server. No user interaction is required, and the attack can be carried out over the network. Exposure is greatest for internet-facing farms and farms with many user accounts.

Affected

• Microsoft SharePoint Server Subscription Edition, versions 16.0.0 to before 16.0.20326.20190 (range from the CNA record; the lower bound is from a third-party database and not confirmed by the vendor)
• SharePoint 2016 and 2019: Unknown.

Fixed in

• Microsoft SharePoint Server Subscription Edition build 16.0.20326.20190 or later, via security update KB5002927 (October 13, 2026)
• The update must be applied to a release version of Subscription Edition.
• Before installing, check the install prerequisite described in the research notes for farms at the September 2025 CU.

Workaround

• No vendor workaround known. Patching is the remedy.
• Generic measures (not vendor-sourced): apply least privilege, monitor administrative activity, and segment the network to limit what low-privileged accounts can reach.

Exploitation

• CISA KEV: not listed.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Microsoft temporal vector: exploit code maturity 'unproven' (E:U).
• No confirmed in-the-wild exploitation reported by a third-party tracker; EPSS 2.0%.
• No public proof of concept found. This does not rule one out.

Our recommendation

• Identify all SharePoint Server Subscription Edition farms and check whether they are internet-facing.
• Apply KB5002927 with priority, after checking the install prerequisite.
• Review accounts with SharePoint or domain access and remove unneeded accounts and permissions.
• Monitor for unusual administrative activity and privilege changes.
• Confirm the status of any SharePoint 2016 or 2019 farms directly with Microsoft, as their status is Unknown.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-96044 msrc.microsoft.com
• Microsoft KB5002927 support.microsoft.com
• Stefan Gossner blog: SharePoint security fixes October 2026 blog.stefan-gossner.com
• OpenCVE: CVE-2026-96044 app.opencve.io
• Senserva: KB5002927 senserva.com
• VulDB: CVE-2026-96044 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:57.