CVE-2026-55051: Microsoft SharePoint Server SSRF Vulnerability

CVE-2026-55051 Overview

CVE-2026-55051 is a Server-Side Request Forgery (SSRF) vulnerability affecting Microsoft Office SharePoint Server. The flaw allows an authenticated attacker with low privileges to coerce the SharePoint server into issuing requests to arbitrary network destinations. Successful exploitation results in disclosure of information reachable from the SharePoint host, including internal services that would otherwise be inaccessible from the public network. Microsoft published guidance for this issue in the Microsoft Security Update Guide, and the vulnerability is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
An authorized attacker can leverage the SharePoint server as a proxy to reach internal endpoints and disclose sensitive information, including cloud metadata services and intranet resources.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2016 Enterprise
Microsoft SharePoint Server 2019

Discovery Timeline

2026-07-14 - CVE-2026-55051 published to the National Vulnerability Database
2026-07-16 - Last updated in the NVD database

Technical Details for CVE-2026-55051

Vulnerability Analysis

The vulnerability is a Server-Side Request Forgery flaw in Microsoft SharePoint Server. SharePoint processes user-controlled input that is subsequently used to construct outbound HTTP requests without sufficient validation of the destination. An authenticated attacker submits a request that instructs the SharePoint server to fetch a resource from an attacker-chosen URL. The server then issues that request from its own network context and returns response data to the attacker.

Because the request originates from the SharePoint host, it bypasses perimeter controls that normally isolate internal services. Attackers can reach internal APIs, cloud instance metadata endpoints, and adjacent SharePoint farms. Exploitation requires valid credentials but does not require user interaction. The vulnerability affects confidentiality of data reachable by the SharePoint service account.

Root Cause

The root cause is insufficient validation of URLs consumed by a SharePoint feature that performs server-side HTTP fetches. SharePoint does not adequately restrict the target scheme, host, or address range before dispatching the request. This design gap enables the request-forgery pattern described in CWE-918.

Attack Vector

Exploitation occurs over the network against a SharePoint web front end. The attacker must first authenticate to SharePoint with any low-privilege account. The attacker then submits a crafted request containing a URL that points to an internal resource. SharePoint executes the outbound request and returns the response contents to the attacker. Refer to the Microsoft Security Update Guide advisory for CVE-2026-55051 for vendor-specific technical detail.

Detection Methods for CVE-2026-55051

Indicators of Compromise

Outbound HTTP or HTTPS connections from SharePoint web front-end processes (w3wp.exe) to internal RFC1918 addresses, loopback, or cloud metadata endpoints such as 169.254.169.254.
SharePoint Unified Logging Service (ULS) entries showing unusual URL parameters in requests to endpoints that perform server-side fetches.
IIS access logs containing authenticated requests with URL-encoded internal hostnames or IP literals in query parameters or request bodies.

Detection Strategies

Baseline expected outbound destinations for the SharePoint application pool identity and alert on deviations to internal or metadata addresses.
Inspect IIS logs for authenticated POST or GET requests to SharePoint endpoints that accept URL parameters, correlating with unexpected outbound connections from the same process.
Monitor SharePoint audit logs for low-privilege accounts issuing high volumes of requests to endpoints that trigger server-side HTTP calls.

Monitoring Recommendations

Forward IIS, ULS, and Windows Security event logs from SharePoint servers to a centralized SIEM for correlation with network flow data.
Enable network egress logging on SharePoint subnets and alert on connections to link-local, loopback, or unexpected internal ranges.
Track authentication events for SharePoint service accounts and flag session activity that precedes anomalous outbound traffic.

How to Mitigate CVE-2026-55051

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update Guide for CVE-2026-55051 to all affected SharePoint Server installations.
Inventory SharePoint Server 2016, 2019, and Subscription Edition deployments and prioritize internet-exposed farms for patching.
Review authentication logs for suspicious low-privilege account activity that predates the patch installation.

Patch Information

Microsoft has released security updates addressing CVE-2026-55051 for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Administrators should consult the Microsoft Security Update Guide advisory to identify the correct cumulative update for each edition. Apply updates in a staged manner to a test farm before production rollout, and confirm SharePoint services restart cleanly after installation.

Workarounds

Restrict outbound network access from SharePoint web front-end servers using host or perimeter firewalls, blocking traffic to cloud metadata endpoints and unnecessary internal ranges.
Enforce least-privilege access to SharePoint sites so that only trusted users hold authenticated accounts capable of triggering server-side fetches.
Place SharePoint behind a reverse proxy or web application firewall that inspects and filters request parameters containing URL values.

bash

# Example egress restriction on a SharePoint host using Windows Firewall
# Block outbound traffic from the SharePoint application pool host to the cloud metadata service
New-NetFirewallRule -DisplayName "Block SharePoint SSRF to IMDS" `
  -Direction Outbound `
  -RemoteAddress 169.254.169.254 `
  -Action Block `
  -Profile Any `
  -Protocol TCP