CVE-2026-69943: Microsoft Office SharePoint Remote Code Execution Vulnerability
Published Oct 13, 2026
·Updated
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Other sources
Microsoft Office SharePoint Remote Code Execution Vulnerability
— Microsoft
Affected Software
6 affected componentsFixes available
Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Server 2019
Microsoft SharePoint Server Subscription Edition<16.0.20326.20190
16.0.20326.20190
Microsoft SharePoint Server<16.0.20326.20190
Microsoft SharePoint Server=2016
Microsoft SharePoint Server=2019
Remediation
Event History
Oct 13, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
DescriptionSeverity
Data Sourced
via NVD·07:19 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Who can exploit this vulnerability?
An attacker must be authorized to access the affected SharePoint environment. Exploitation can be performed over the network and does not require user interaction.
2
Which SharePoint versions are identified as affected?
The affected products listed are Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition.
3
What level of impact could successful exploitation have?
Successful exploitation allows code execution. The supplied severity vector indicates high confidentiality, integrity, and availability impact.