CVE-2026-85932: Microsoft Office SharePoint Information Disclosure Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
Other sources
Microsoft Office SharePoint Information Disclosure Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.20326.20190Patch KB5002927
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authorized, meaning they need valid access to the affected SharePoint Server Subscription Edition environment. Exploitation can be performed over a network and does not require user interaction.
What is the likely impact if exploitation succeeds?
The vulnerability can allow disclosure of information. The provided severity vector indicates high confidentiality impact, with no stated integrity or availability impact.
What component should be prioritized for assessment?
Assess Microsoft SharePoint Server Subscription Edition deployments, particularly network-accessible instances where authorized users can supply or influence pathnames.