CVE-2026-102865: SharePoint Server Information Disclosure

CVE-2026-102865 Overview

CVE-2026-102865 is an incorrect authorization vulnerability [CWE-863] in Microsoft Office SharePoint Server. An authenticated attacker with low privileges can disclose sensitive information over a network by bypassing authorization checks. The flaw affects the SharePoint Server subscription edition and does not require user interaction. Successful exploitation compromises confidentiality but does not affect data integrity or service availability.

Critical Impact
Authenticated attackers can retrieve information they should not have access to, enabling reconnaissance and data theft from SharePoint document stores and site collections.

Affected Products

Microsoft SharePoint Server (Subscription Edition)
SharePoint-hosted sites and document libraries relying on the server's authorization logic
Enterprise collaboration workloads integrated with the affected SharePoint deployment

Discovery Timeline

2026-10-13 - CVE CVE-2026-102865 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-102865

Vulnerability Analysis

The vulnerability resides in SharePoint Server's authorization logic. The server fails to correctly verify whether an authenticated principal has permission to access targeted resources before returning them. An attacker holding any valid low-privilege account on the SharePoint tenant can craft requests that reference objects outside their granted scope. The server processes these requests and returns protected content instead of denying the operation.

The network attack surface is reachable through standard SharePoint HTTP(S) endpoints. No user interaction is required, and attack complexity is low. Exploitation does not alter data or disrupt service, which keeps the impact bounded to confidentiality. Targets of interest include document libraries, list items, site metadata, and permission structures that normally require elevated roles.

Root Cause

The root cause is classified as incorrect authorization [CWE-863]. SharePoint performs authentication correctly but applies insufficient or inconsistent checks when evaluating whether the authenticated identity is authorized for a specific resource or operation. This gap allows horizontal access to data owned by other users or sites.

Attack Vector

The attack vector is network-based and requires an authenticated session with low privileges. An attacker sends crafted requests to vulnerable SharePoint endpoints, manipulating identifiers or parameters that reference restricted resources. Because the server trusts the request after authentication, it returns the content without enforcing the full authorization policy. Microsoft has not published public exploitation details. Refer to the Microsoft Security Response Center advisory for CVE-2026-102865 for authoritative technical information.

Detection Methods for CVE-2026-102865

Indicators of Compromise

Unusual volumes of successful GET requests from a single authenticated user to document libraries or list endpoints across multiple site collections.
Access patterns where a low-privilege account retrieves resources it has never requested before, especially administrative or restricted site metadata.
SharePoint Unified Logging Service (ULS) entries showing successful object access without a preceding permission grant event.

Detection Strategies

Enable and forward SharePoint audit logs covering file views, list item access, and permission queries to a centralized analytics platform.
Baseline per-user access patterns and alert on deviations such as sudden cross-site enumeration or bulk document retrieval.
Correlate authentication events with resource-access events to identify authorization decisions that appear inconsistent with assigned roles.

Monitoring Recommendations

Monitor IIS and SharePoint logs for anomalous query strings, repeated requests to object identifiers, and sequential ID enumeration.
Track accounts that generate authorization failures interleaved with unexpected successes against the same endpoints.
Review Microsoft 365 Defender and Microsoft Purview audit signals for SharePoint access anomalies tied to the affected server version.

How to Mitigate CVE-2026-102865

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-102865 to all affected SharePoint Server subscription edition instances.
Audit SharePoint site permissions and remove unnecessary access grants, especially broad Everyone or Authenticated Users entries.
Rotate credentials for service accounts and administrative users if suspicious access patterns are identified.

Patch Information

Microsoft has released a security update addressing this vulnerability. Review the Microsoft Security Response Center advisory for CVE-2026-102865 and install the referenced update through standard patch management processes. Validate installation across all SharePoint front-end and application servers in the farm.

Workarounds

Restrict network access to SharePoint endpoints using firewall rules, VPN requirements, or conditional access policies while the patch is being deployed.
Enforce least-privilege permissions on site collections, document libraries, and lists to reduce the data exposed if authorization is bypassed.
Enable multi-factor authentication on all SharePoint accounts to raise the cost of credential compromise required for exploitation.

bash

# Configuration example: audit SharePoint permissions via PowerShell
Get-SPSite -Limit All | ForEach-Object {
    $site = $_
    $site.RootWeb.SiteUsers | Where-Object { $_.LoginName -match 'Everyone|Authenticated Users' } |
        Select-Object @{Name='Site';Expression={$site.Url}}, LoginName, Roles
}