CVE-2026-105713: Microsoft SharePoint Server SSRF Vulnerability

CVE-2026-105713 Overview

CVE-2026-105713 is a Server-Side Request Forgery (SSRF) vulnerability in Microsoft Office SharePoint Server [CWE-918]. An authenticated attacker on an adjacent network can exploit the flaw to perform spoofing by inducing the SharePoint server to issue requests on their behalf. The vulnerability affects Microsoft SharePoint Server subscription edition and was published to the National Vulnerability Database on 2026-10-13.

Critical Impact

An authorized attacker with low privileges on an adjacent network can coerce SharePoint into issuing crafted requests, enabling spoofing and disclosure of sensitive internal resources.

Affected Products

• Microsoft SharePoint Server (Subscription Edition)
• Deployments exposing SharePoint services on reachable adjacent networks
• Environments permitting low-privileged authenticated users

Discovery Timeline

• 2026-10-13 - CVE-2026-105713 published to NVD
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-105713

Vulnerability Analysis

The vulnerability resides in SharePoint Server functionality that accepts user-controlled URLs or resource identifiers and dispatches server-side requests without sufficient validation of the destination. An authenticated attacker on an adjacent network can supply crafted input that redirects SharePoint's outbound requests toward attacker-chosen targets. The server's identity and network position are then used to spoof requests to resources that would normally be unreachable from the attacker's location.

Because SharePoint typically runs with privileged service identities and sits inside protected network segments, abuse of SSRF primitives can be used to pivot requests to internal endpoints. The flaw yields confidentiality impact without affecting integrity or availability of SharePoint itself, per the published CVSS vector.

Root Cause

The root cause is insufficient validation and allowlisting of request destinations in a SharePoint component that performs server-initiated HTTP or URI retrieval. Classified under [CWE-918] (Server-Side Request Forgery), the issue allows the server to be tricked into fetching or interacting with URIs supplied by the attacker.

Attack Vector

Exploitation requires network adjacency (AV:A), low privileges (PR:L), and no user interaction. The attacker authenticates to SharePoint, submits a crafted request containing an attacker-controlled URL, and the server performs the outbound request. The response or side effects can be leveraged to spoof identity to internal services or expose data accessible from the server's network position.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-105713

Indicators of Compromise

• Unexpected outbound HTTP or HTTPS requests originating from the SharePoint application pool identity to internal hosts, metadata endpoints, or loopback addresses
• SharePoint IIS logs showing authenticated requests containing URL parameters pointing to non-SharePoint internal resources
• Anomalous DNS lookups from the SharePoint server to internal-only hostnames not referenced by application configuration

Detection Strategies

• Baseline normal outbound destinations for SharePoint service accounts and alert on deviations, especially requests to RFC1918 ranges, link-local addresses, or cloud metadata services
• Inspect IIS and SharePoint ULS logs for request parameters that embed URLs, IP literals, or encoded schemes targeting internal resources
• Correlate authenticated SharePoint sessions from adjacent subnets with outbound server-initiated traffic patterns

Monitoring Recommendations

• Enable verbose logging on SharePoint endpoints that accept URL-valued parameters and forward logs to a centralized SIEM
• Monitor egress firewall logs for SharePoint-originated traffic that bypasses expected proxies or targets management interfaces
• Alert on authentication events from low-privileged accounts followed by atypical server-initiated requests

How to Mitigate CVE-2026-105713

Immediate Actions Required

• Apply the Microsoft security update referenced in the vendor advisory as soon as change windows permit
• Restrict SharePoint access to trusted network segments and enforce network segmentation to reduce adjacent-network exposure
• Review and tighten privileges for authenticated SharePoint users, particularly accounts reachable from guest or partner subnets

Patch Information

Microsoft has published guidance and a security update for this issue. Review and deploy the fix documented in the Microsoft Security Update CVE-2026-105713 advisory.

Workarounds

• Place an egress filter in front of SharePoint servers that denies outbound traffic to internal management ranges, cloud metadata endpoints, and loopback addresses
• Require strong authentication and limit SharePoint reachability from adjacent networks using firewall and VLAN controls
• Disable or restrict SharePoint features that accept user-supplied URLs if not required by business workflows

# Example egress restriction concept for SharePoint host (Windows Firewall)
New-NetFirewallRule -DisplayName "Block SharePoint to Metadata" `
  -Direction Outbound -Action Block `
  -RemoteAddress 169.254.169.254 `
  -Program "C:\Windows\System32\inetsrv\w3wp.exe"