CVE-2026-70259: Microsoft Office SharePoint Information Disclosure Vulnerability
Microsoft Office SharePoint Information Disclosure Vulnerability
Other sources
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.20326.20190Patch KB5002927
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authorized, meaning they need an account or permissions accepted by the affected SharePoint Server Subscription Edition deployment. Exploitation can be performed over the network and does not require user interaction.
What is the likely impact of successful exploitation?
Successful exploitation can disclose information. The supplied severity vector indicates high confidentiality impact, with no integrity or availability impact indicated.
Is a default SharePoint Server Subscription Edition deployment affected?
The provided data identifies SharePoint Server Subscription Edition as affected but does not state whether exploitation depends on default configuration, a specific feature, or particular deployment settings.
What can be done if patching cannot be performed immediately?
The provided information does not include mitigations or workarounds. Since exploitation requires authorization, review and restrict access for SharePoint accounts where feasible until vendor guidance or an update is applied.