CVE-2026-102861: Microsoft Office SharePoint Elevation of Privilege Vulnerability
Microsoft Office SharePoint Elevation of Privilege Vulnerability
Other sources
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.20326.20190Patch KB5002927
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must already be authorized to access the affected SharePoint deployment. Exploitation can be performed over the network and does not require user interaction.
What level of impact could successful exploitation have?
Successful exploitation could allow privilege elevation. The reported severity metrics indicate high potential impact to confidentiality, integrity, and availability.
Are default SharePoint configurations affected?
The available information does not state whether the vulnerable condition is present in a default configuration or identify any configuration prerequisites.
What can be done if patching cannot happen immediately?
Because exploitation requires an authorized attacker, restrict SharePoint access to necessary users and review authorization assignments for excessive privileges. The provided information does not identify a product-specific workaround.