CVE-2026-70266: Microsoft Office SharePoint Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Other sources
Microsoft Office SharePoint Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.20326.20190Patch KB5002927
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authorized to access the affected SharePoint Server Subscription Edition instance. Exploitation can be performed over the network and does not require user interaction.
What access does a successful attacker gain?
Successful exploitation allows elevation of privileges. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability.
Is this exploitable without credentials?
No. The vulnerability description specifies that the attacker must be authorized, and the vector lists privileges required as low.