CVE-2026-47298: SharePoint RCE Vulnerability

CVE-2026-47298 Overview

CVE-2026-47298 is an improper authorization vulnerability [CWE-285] in Microsoft Office SharePoint. An authorized attacker can leverage missing authorization checks to execute code over a network. Exploitation requires low-privileged authentication and user interaction, but the impact spans confidentiality, integrity, and availability of the affected SharePoint server.

Microsoft published the advisory on June 9, 2026. The vulnerability has not been reported as exploited in the wild and is not listed in the CISA Known Exploited Vulnerabilities catalog at this time.

Critical Impact
An authenticated attacker can bypass authorization controls in SharePoint to execute arbitrary code over the network, compromising server confidentiality, integrity, and availability.

Affected Products

Microsoft Office SharePoint (see the Microsoft Security Update CVE-2026-47298 advisory for the full list of affected builds)

Discovery Timeline

2026-06-09 - CVE-2026-47298 published to the National Vulnerability Database
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-47298

Vulnerability Analysis

The flaw is classified as [CWE-285] Improper Authorization. SharePoint fails to correctly enforce authorization checks on a code path that ultimately reaches a code execution sink. An attacker who already holds valid credentials can submit a crafted request that the server processes outside its intended authorization boundary.

The attack vector is network-based and the attack complexity is low, but successful exploitation requires user interaction. Once exploited, the attacker gains code execution within the SharePoint application context, allowing data theft, content tampering, or service disruption on the host.

Because SharePoint frequently stores sensitive collaboration content and connects to identity providers, downstream impact can extend beyond the server itself. Compromise of a SharePoint instance often supports lateral movement into Microsoft 365 tenants and on-premises Active Directory environments.

Root Cause

The root cause is missing or insufficient authorization enforcement on a privileged operation. SharePoint trusts a request attribute or session state that an authenticated low-privileged user can influence. The server then executes code paths reserved for higher-privileged callers without re-validating the caller's effective rights.

Attack Vector

An attacker with a valid low-privileged SharePoint account sends a crafted HTTP request to the targeted site. The exploit chain requires the victim to perform an action such as clicking a link or opening a document hosted on the malicious site. After the server accepts the request, the unauthorized code path executes with the application identity. Microsoft has not published technical details of the proof-of-concept. Review the Microsoft Security Update CVE-2026-47298 for vendor guidance.

Detection Methods for CVE-2026-47298

Indicators of Compromise

Unexpected child processes spawned by w3wp.exe running under the SharePoint application pool identity.
Anomalous writes to SharePoint _layouts, _vti_bin, or TEMPLATE directories on the web front-end.
HTTP requests from low-privileged accounts targeting administrative or callback endpoints outside their normal usage pattern.
New scheduled tasks, services, or assemblies registered on SharePoint servers shortly after suspicious authenticated traffic.

Detection Strategies

Correlate IIS logs with SharePoint Unified Logging Service (ULS) entries to identify authenticated requests that reach privileged handlers without matching authorization events.
Hunt for process-tree anomalies originating from the SharePoint worker process, especially launches of cmd.exe, powershell.exe, or scripting engines.
Baseline normal request patterns per user role and alert on deviations to administrative APIs.

Monitoring Recommendations

Forward IIS, ULS, and Windows Security event logs to a centralized analytics platform for retention and correlation.
Monitor for newly created SharePoint solutions, features, or web parts outside change-control windows.
Track outbound network connections from SharePoint servers to detect post-exploitation command-and-control behavior.

How to Mitigate CVE-2026-47298

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update CVE-2026-47298 advisory to all affected SharePoint servers.
Audit SharePoint user accounts and remove unused or over-privileged identities that could be used to satisfy the authentication requirement.
Enforce multi-factor authentication on every account with SharePoint access to raise the cost of credential abuse.
Review recent IIS and ULS logs for suspicious authenticated activity preceding patch deployment.

Patch Information

Microsoft has released a security update through the Microsoft Update Guide. Administrators should consult the Microsoft Security Update CVE-2026-47298 page to identify the correct cumulative update for each SharePoint version in their environment and validate installation through the SharePoint Central Administration site.

Workarounds

Restrict SharePoint access to trusted networks using a reverse proxy or web application firewall until patches are deployed.
Disable or tightly scope features that allow low-privileged users to upload content or trigger server-side processing.
Apply the principle of least privilege to the SharePoint application pool account to limit the blast radius of code execution.

bash

# Example: list installed SharePoint updates to verify patch deployment
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# Example: enumerate SharePoint farm build to confirm patched version
Get-SPFarm | Select-Object BuildVersion