CVE-2026-20951: Microsoft SharePoint Server RCE Flaw

CVE-2026-20951 Overview

CVE-2026-20951 is an improper input validation vulnerability [CWE-20] in Microsoft Office SharePoint that allows an unauthorized attacker to execute code locally. The flaw affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. Exploitation requires user interaction, such as opening a crafted document or following a malicious link. Successful exploitation results in high impact to confidentiality, integrity, and availability of the affected host.

Critical Impact

An attacker who convinces a user to open malicious content can run arbitrary code in the context of the user, leading to full compromise of the local system.

Affected Products

• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

• 2026-01-13 - CVE-2026-20951 published to NVD
• 2026-01-14 - Last updated in NVD database

Technical Details for CVE-2026-20951

Vulnerability Analysis

The vulnerability stems from improper input validation in Microsoft Office SharePoint components. When SharePoint processes specially crafted input, it fails to enforce expected constraints before passing data to downstream code paths. This allows an attacker to influence execution flow and run arbitrary code in the local user context.

The issue is local in scope and requires user interaction. An attacker must convince a target to open a malicious file or interact with attacker-controlled content. No prior authentication to SharePoint is required for the attacker to stage the exploit payload.

A successful attack yields high impact to confidentiality, integrity, and availability. The attacker inherits the privileges of the user who triggers the vulnerable code path.

Root Cause

The defect is classified under [CWE-20] Improper Input Validation. SharePoint accepts data without verifying that the structure, type, or content matches what the parsing logic expects. This validation gap allows malformed input to reach code that assumes well-formed data, producing a state suitable for code execution.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted SharePoint-related artifact through email, removable media, or a web-hosted lure. When the user opens the artifact, the affected SharePoint component parses it and executes the embedded payload. Refer to the Microsoft CVE-2026-20951 Update Guide for component-level details.

Detection Methods for CVE-2026-20951

Indicators of Compromise

• Unexpected child processes spawned by SharePoint or Office worker processes such as w3wp.exe or Office applications interacting with SharePoint content.
• Creation of executables, scripts, or scheduled tasks shortly after a user opens a SharePoint-linked document.
• Outbound network connections from user workstations to unfamiliar hosts immediately after SharePoint content is accessed.

Detection Strategies

• Monitor process lineage for SharePoint and Office components launching interpreters such as powershell.exe, cmd.exe, wscript.exe, or mshta.exe.
• Hunt for anomalous file writes to user profile and startup locations following SharePoint document interactions.
• Correlate endpoint telemetry with email and proxy logs to identify delivery of crafted SharePoint files.

Monitoring Recommendations

• Enable detailed process creation auditing (Event ID 4688) with command-line logging on systems that access SharePoint content.
• Forward SharePoint server logs and endpoint EDR telemetry to a central data lake for cross-source correlation.
• Track patch deployment state across SharePoint Server 2016, 2019, and Subscription Edition hosts to prioritize at-risk endpoints.

How to Mitigate CVE-2026-20951

Immediate Actions Required

• Apply the security updates referenced in the Microsoft CVE-2026-20951 Update Guide to all affected SharePoint Server installations.
• Inventory SharePoint Server Subscription Edition, 2019, and 2016 Enterprise instances and confirm patch status.
• Restrict who can upload and share documents through SharePoint until patching completes.

Patch Information

Microsoft has published guidance and update packages through the Microsoft CVE-2026-20951 Update Guide. Administrators should apply the corresponding cumulative updates for each affected SharePoint version and validate functionality in a staging environment before broad rollout.

Workarounds

• Train users to avoid opening unsolicited SharePoint documents or links from untrusted sources.
• Enforce Protected View and Attack Surface Reduction rules on workstations that consume SharePoint content.
• Limit local administrative rights so that successful exploitation does not yield elevated privileges.

# Configuration example: verify SharePoint patch level on Windows Server
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
Get-SPProduct -Local