CVE-2026-64921: Microsoft SharePoint Server Elevation of Privilege Vulnerability
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Other sources
Missing authentication for critical function in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.19725.20522Patch KB5002893 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.5565.1001Patch KB5002906 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.10417.20198Patch KB5002896
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64921?
The severity of CVE-2026-64921 is high, with a CVSS score of 8.8.
How do I fix CVE-2026-64921?
To fix CVE-2026-64921, ensure that your Microsoft SharePoint Server is updated to the latest security patch provided by Microsoft.
What impact does CVE-2026-64921 have on my SharePoint Server?
CVE-2026-64921 allows an authorized attacker to elevate their privileges, which can lead to unauthorized access to critical functionalities.
Which versions of SharePoint Server are affected by CVE-2026-64921?
CVE-2026-64921 affects Microsoft SharePoint Server Subscription Edition, SharePoint Enterprise Server 2016, and SharePoint Server 2019.
Is my network safe if I use Microsoft SharePoint Server with CVE-2026-64921?
Using an unpatched version of Microsoft SharePoint Server affected by CVE-2026-64921 presents a risk as it allows potential privilege escalation by authenticated attackers.