cbcvebase.
CVE-2026-26106
published 2026-03-10

CVE-2026-26106: Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

PriorityP264high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.37%
68.7th percentile
Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Affected

9 ranges
VendorProductVersion rangeFixed in
microsoftmicrosoft_sharepoint_enterprise_server_2016>= 16.0.0 < 16.0.5543.100016.0.5543.1000
microsoftmicrosoft_sharepoint_server_2019>= 16.0.0 < 16.0.10417.2010216.0.10417.20102
microsoftmicrosoft_sharepoint_server_subscription_edition>= 16.0.0 < 16.0.19725.2007616.0.19725.20076
microsoftsharepoint_server< 16.0.19725.2007616.0.19725.20076
microsoftsharepoint_server
microsoftsharepoint_server
msrcmicrosoft_sharepoint_enterprise_server_2016
msrcmicrosoft_sharepoint_server_2019
msrcmicrosoft_sharepoint_server_subscription_edition

Detection & IOCsextracted from sources · hover to see the quote

  • Attacker must be authenticated with at minimum Site Member permissions (PR:L) to exploit this SharePoint RCE; monitor for unusual code execution originating from low-privileged SharePoint site member accounts.
  • The vulnerability is network-based; monitor SharePoint Server for anomalous inbound network requests from authenticated but low-privileged users that result in process spawning or unexpected code execution.
  • ·Both SharePoint Server 2016 and SharePoint Enterprise Server 2016 are affected and share the same KB update number; ensure both variants are patched.
  • ·Any authenticated user can trigger this vulnerability — admin or elevated privileges are NOT required, broadening the attack surface to all site members.
  • ·Affected product scope is SharePoint Server (Subscription edition and others); confirm patch KB5002850, KB5002845, and KB5002843 are applied per the MSRC update guide.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.