Vulnerabilities
CVE-2026-102862: SharePoint Elevation of Privilege Vulnerability
Microsoft Office SharePoint is vulnerable to an elevation of privilege flaw (CVE‑2026‑102862) that allows an authenticated attacker to gain higher permissions on a network. The flaw affects SharePoint Server 2013/2016/2019 and SharePoint Online. Defenders should apply the latest cumulative update, audit permissions, and monitor for unauthorized privilege changes.
What Happened
Microsoft Office SharePoint has a flaw in its authorization logic that permits an attacker who already has authenticated access to a SharePoint site to elevate their privileges to a higher level, potentially becoming a site collection administrator.
Impact
Authenticated users with access to a vulnerable SharePoint instance can gain elevated rights, enabling them to modify site settings, add or remove users, and potentially access sensitive corporate data. The vulnerability is rated high severity (CVSS 8.8) and can be exploited over the network without additional privileges.
Mitigation
- Apply the latest cumulative update for SharePoint Server 2013, 2016, 2019, and SharePoint Online (MSRC-2026-102862).
- Review and restrict the “Manage Permissions” permission level; enforce least‑privilege for all users.
- Audit site collection administrators and monitor for unexpected changes.
- Enable logging for permission changes and review logs regularly.
Detection & Response
- Check the SharePoint ULS logs and audit logs for privilege escalation events.
- Set alerts for changes to the site collection administrator group.
- If a breach is suspected, isolate the affected SharePoint instance, apply the patch, and conduct a forensic review.
Related vulnerabilities
CVE-2026-102866: SharePoint Elevation of Privilege via Signature Bypass
Microsoft Office SharePoint is vulnerable to an elevation of privilege flaw that allows an attacker to bypass cryptographic signature verification and gain elevated rights over the network. The flaw is identified as CVE-2026-102866 and affects all versions of SharePoint that rely on Office cryptographic validation. Defenders should apply the latest Microsoft security update, verify signature checks, and monitor for suspicious privilege changes.
Read briefing
CVE-2026-102860: SharePoint Elevation of Privilege via Improper Access Control
Microsoft Office SharePoint contains an access‑control flaw that permits an authenticated user to elevate privileges across the network. The vulnerability, identified as CVE‑2026‑102860, could allow attackers to gain higher‑level permissions within SharePoint environments. Defenders should verify patch status, restrict privileged access, and monitor for anomalous privilege changes.
Read briefing
CVE-2026-105720: SharePoint Elevation of Privilege Vulnerability
A flaw in Microsoft Office SharePoint’s authorization logic lets an authenticated user gain higher privileges on the network. The issue affects all SharePoint deployments that have not applied the latest security update. Apply the patch immediately and audit user permissions.
Read briefing
CVE-2026-65787: Desktop Window Manager Elevation of Privilege Vulnerability
Microsoft has acknowledged CVE-2026-65787, an elevation of privilege flaw in the Desktop Window Manager (DWM) component of Windows. The issue could allow local attackers to gain higher privileges. Defenders should ensure the latest Windows updates are installed and monitor for vendor advisories.
Read briefing