CVE-2026-55052: Microsoft SharePoint Privilege Escalation

CVE-2026-55052 Overview

CVE-2026-55052 is a missing authorization vulnerability [CWE-862] in Microsoft Office SharePoint that allows an authorized attacker to elevate privileges over a network. The flaw affects Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. An attacker with low-privilege network access can exploit the vulnerability to compromise confidentiality, integrity, and availability of the target SharePoint environment. Microsoft published guidance for the issue through the Microsoft Security Response Center (MSRC).

Critical Impact
An authenticated attacker with low privileges can escalate to higher privileges across SharePoint content and administrative functions over the network, without user interaction.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2026-07-14 - CVE-2026-55052 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55052

Vulnerability Analysis

The vulnerability is a missing authorization weakness classified under [CWE-862]. SharePoint fails to verify that a requesting user holds the required permissions before executing a privileged operation. An authenticated user can therefore invoke functionality that should be restricted to higher-privileged roles. Because SharePoint hosts collaboration content, document libraries, and site administration APIs, a successful escalation can grant broad control over site collections and their data.

Root Cause

The root cause is an absent or incomplete authorization check on a network-accessible SharePoint code path. When a request reaches the vulnerable handler, the server processes the action based on authentication alone rather than validating the caller's role or object-level permissions. This design gap enables horizontal and vertical privilege escalation depending on the targeted endpoint.

Attack Vector

Exploitation requires network access to a SharePoint Server instance and valid low-privilege credentials. No user interaction is needed. The attacker sends a crafted request to the affected endpoint, and the server executes the privileged operation without confirming the caller's authorization. Successful exploitation impacts confidentiality, integrity, and availability of hosted SharePoint content and configuration.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Refer to the Microsoft Security Update CVE-2026-55052 advisory for authoritative technical details.

Detection Methods for CVE-2026-55052

Indicators of Compromise

Unexpected permission changes on SharePoint site collections, lists, or libraries performed by low-privilege accounts.
Anomalous HTTP requests to SharePoint administrative or web service endpoints (/_layouts/, /_api/, /_vti_bin/) from standard user sessions.
New site collection administrators or role assignments not correlated with change management records.
Access to documents or lists that a user's baseline role should not permit.

Detection Strategies

Audit SharePoint ULS logs for privileged operations executed by accounts without the corresponding role assignments.
Correlate IIS access logs with SharePoint audit events to identify requests where authorization decisions appear inconsistent with the caller's group membership.
Baseline normal API and web service call patterns per user role and alert on deviations, particularly bursts of _api calls from standard users.

Monitoring Recommendations

Enable SharePoint auditing for content, security, and administrative events across all site collections.
Forward IIS, ULS, and Windows Security logs to a centralized SIEM for cross-source correlation.
Monitor Active Directory and SharePoint group membership changes in near real time.

How to Mitigate CVE-2026-55052

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update CVE-2026-55052 advisory to all affected SharePoint Server installations.
Review site collection administrator lists and remove accounts that do not require elevated access.
Rotate credentials for any accounts suspected of unauthorized use following patch deployment.
Restrict SharePoint web front-end exposure to trusted network segments where feasible.

Patch Information

Microsoft has published the update guide for CVE-2026-55052 through MSRC. Administrators should apply the corresponding cumulative update or security patch for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. Consult the Microsoft Security Update CVE-2026-55052 advisory for the specific build numbers and installation prerequisites.

Workarounds

Reduce attack surface by limiting SharePoint access to authenticated users on internal networks and requiring VPN or Zero Trust Network Access for remote users.
Enforce least privilege by reviewing SharePoint group memberships and removing unnecessary contribute, design, or full-control permissions.
Enable multi-factor authentication on all accounts with access to SharePoint to raise the cost of credential-based exploitation.

bash

# Example: enumerate SharePoint site collection administrators via PowerShell
Add-PSSnapin Microsoft.SharePoint.PowerShell
Get-SPSite -Limit All | ForEach-Object {
    $site = $_
    $site.RootWeb.SiteAdministrators | Select-Object `
        @{Name='Site';Expression={$site.Url}}, LoginName, Email
}