TI-2026-73376 Aliases CVE-2026-105720 GHSA-f9hx-6hhf-frhr

Incorrect authorization in SharePoint allows privilege escalation

LOW 23CWE-863Published 2026-10-13 · Updated 2026-10-31

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Microsoft SharePoint Server Subscription Edition from 16.0.0 before 16.0.20326.20190 is affected. Incorrect authorization (CWE-863) lets an authorized attacker over the network gain higher privileges. The attacker needs low privileges and no user interaction, and the impact is limited to integrity.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00492 42nd percentileScored 2026-11-07

Fix Fixed Microsoft SharePoint Server Subscription Edition (Microsoft): 16.0.20326.20190

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	Microsoft SharePoint Server Subscription Edition	16.0.0 to before 16.0.20326.20190	16.0.20326.20190	Patch available	CNA

Microsoft SharePoint Server Subscription Edition VendorMicrosoft Affected 16.0.0 to before 16.0.20326.20190 Fixed in 16.0.20326.20190 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:sharepoint_server:::::subscription:::*	before 16.0.20326.20190	Vulnerable	Microsoft

cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:* Versions before 16.0.20326.20190 Vulnerable ·Microsoft

Remediation

Update Microsoft SharePoint Server Subscription Edition to version 16.0.20326.20190 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Microsoft SharePoint Server Subscription Edition (Microsoft) Fixed in 16.0.20326.20190

Timeline

2026-10-13 Threatist record created from CVE-2026-105720
2026-10-13 CISA SSVC decision points changed
2026-10-13 Alias added: GHSA-f9hx-6hhf-frhr

References

Patch 1

Microsoft Office SharePoint Elevation of Privilege Vulnerability

TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2023-13749 Microsoft SharePoint Server Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2019-00394 Improper input validation in Microsoft SharePoint Server KEVCVSS 3.1CRITICAL 9.8

See all 631 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences