CVE-2026-108452: Microsoft Office SharePoint Remote Code Execution Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Other sources
Microsoft Office SharePoint Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.20326.20190Patch KB5002927
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be authorized and have low-level privileges, but exploitation can be performed over the network with no user interaction. The attack complexity is rated low.
What is the potential impact of successful exploitation?
Successful exploitation can allow code execution. The provided severity metrics indicate high potential impact to confidentiality, integrity, and availability.
Which SharePoint product is identified as affected?
The affected software listed is Microsoft SharePoint Server Subscription Edition.