CVE-2026-105720: Microsoft SharePoint Server Privilege Escalation

CVE-2026-105720 Overview

CVE-2026-105720 is an incorrect authorization vulnerability in Microsoft Office SharePoint. An authenticated attacker can elevate privileges over a network by exploiting flawed authorization checks within the SharePoint Server platform. The weakness maps to [CWE-863: Incorrect Authorization] and affects Microsoft SharePoint Server subscription edition. Successful exploitation permits an attacker holding low-privileged credentials to perform actions beyond their intended authorization scope, resulting in limited integrity impact on the targeted SharePoint environment.

Critical Impact
An authenticated, low-privileged attacker on the network can bypass authorization controls in Microsoft SharePoint Server to elevate privileges and modify resources outside their permitted scope.

Affected Products

Microsoft SharePoint Server (Subscription Edition)

Discovery Timeline

2026-10-13 - CVE-2026-105720 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-105720

Vulnerability Analysis

The vulnerability resides in SharePoint Server's authorization logic. The server fails to correctly verify that an authenticated user holds sufficient rights to perform specific operations. An attacker with a valid low-privileged account can submit crafted requests that bypass these checks and act with elevated permissions. The vulnerability requires network access to the SharePoint endpoint and user authentication, but no user interaction. Exploitation yields limited integrity impact on the targeted SharePoint instance, with no confirmed confidentiality or availability consequences disclosed by Microsoft.

Root Cause

The root cause is improper enforcement of authorization decisions ([CWE-863]) within SharePoint Server's request handling path. Code paths that should restrict access by role or permission scope evaluate authorization context incorrectly, letting an authenticated principal perform operations reserved for higher-privileged users. Microsoft has not disclosed the specific component or API endpoint affected.

Attack Vector

The attack vector is network-based. An attacker authenticates to a SharePoint site using valid credentials, then issues a crafted request against a resource or operation that enforces authorization inadequately. Because the attacker only needs low privileges and no user interaction, exploitation can be automated once a valid account is obtained. See the Microsoft CVE-2026-105720 Advisory for additional technical details.

Detection Methods for CVE-2026-105720

Indicators of Compromise

Unexpected modifications to SharePoint lists, sites, or permission objects performed by non-administrative accounts.
Audit log entries showing low-privileged users invoking administrative or restricted API endpoints.
Anomalous SharePoint REST or CSOM request patterns originating from standard user sessions.

Detection Strategies

Enable and review SharePoint unified audit logging for permission changes, site collection modifications, and role assignments.
Correlate authentication events with high-privilege action events to identify accounts performing operations outside their normal role.
Baseline SharePoint API usage per account and alert on deviations from expected behavior.

Monitoring Recommendations

Forward SharePoint ULS logs and Microsoft 365 audit logs to a centralized SIEM for continuous analysis.
Monitor for repeated authorization failures followed by successful privileged actions from the same session.
Track administrative role changes and new permission grants in real time.

How to Mitigate CVE-2026-105720

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-105720 Advisory to all affected SharePoint Server instances.
Audit SharePoint accounts and remove unused or stale credentials to reduce the pool of accounts available for abuse.
Enforce multi-factor authentication for all SharePoint users to raise the cost of credential compromise.

Patch Information

Microsoft published the official fix in the Microsoft Security Response Center advisory for CVE-2026-105720. Administrators should consult the advisory for the specific build numbers and cumulative updates that address the authorization flaw in SharePoint Server Subscription Edition.

Workarounds

Restrict network access to SharePoint Server endpoints using segmentation, VPN, or conditional access policies until patches are deployed.
Review and tighten SharePoint permission inheritance, removing broad grants and applying least-privilege role assignments.
Disable or restrict SharePoint features and APIs not required for business operations to reduce the attack surface.

bash

# Configuration example
# Review SharePoint site collection administrators and audit permissions via PowerShell
Get-SPOSite | ForEach-Object {
    Get-SPOUser -Site $_.Url | Where-Object { $_.IsSiteAdmin -eq $true }
}

# Enable unified audit logging in Microsoft 365
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true