CVE-2026-58277: SharePoint Server Privilege Escalation Flaw

CVE-2026-58277 Overview

CVE-2026-58277 is an improper authorization vulnerability in Microsoft Office SharePoint Server. An authenticated attacker can exploit missing authorization checks to elevate privileges over the network. The flaw is tracked under CWE-285: Improper Authorization and affects SharePoint Server 2016 Enterprise and SharePoint Server 2019. Microsoft published guidance in the Microsoft Security Update CVE-2026-58277 advisory.

Critical Impact
An authenticated attacker with low privileges can escalate to higher privileges on the SharePoint server, compromising confidentiality, integrity, and availability of hosted content.

Affected Products

Microsoft SharePoint Server 2016 (Enterprise)
Microsoft SharePoint Server 2019
Microsoft Office SharePoint deployments exposing web-facing services

Discovery Timeline

2026-07-14 - CVE-2026-58277 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-58277

Vulnerability Analysis

CVE-2026-58277 is an improper authorization flaw in Microsoft Office SharePoint Server. The affected code paths fail to enforce access checks before executing privileged operations. An authenticated user with a low-privilege SharePoint account can send crafted network requests to invoke functionality reserved for higher-privileged roles.

Successful exploitation allows the attacker to read, modify, and delete content across site collections. The attacker can also perform administrative actions that were intended to require elevated permissions. Because the vulnerability is network-reachable and has low attack complexity, exploitation requires only valid credentials and no user interaction.

The EPSS score is 0.74% at the 50th percentile, and no public proof-of-concept exploit or CISA KEV listing exists at the time of publication.

Root Cause

The root cause is missing or incorrect authorization enforcement in SharePoint request handlers. Server-side code trusts client-supplied context or omits role validation before executing sensitive operations. This aligns with CWE-285, where an actor performs actions they should not be permitted to perform.

Attack Vector

The attack vector is network-based against the SharePoint web front-end. The attacker must hold valid SharePoint credentials, which can be obtained through phishing, credential stuffing, or lateral movement from a compromised endpoint. Once authenticated, the attacker issues crafted HTTP requests to targeted SharePoint endpoints that bypass authorization checks.

No verified exploitation code is publicly available. Consult the Microsoft Security Update Guide for vendor-supplied technical details.

Detection Methods for CVE-2026-58277

Indicators of Compromise

Unexpected permission changes on site collections, lists, or libraries performed by low-privilege accounts.
SharePoint audit log entries showing administrative actions by users outside expected admin groups.
Anomalous access to _layouts/ or _api/ endpoints from standard user accounts.
Creation or modification of SharePoint groups and role assignments outside change windows.

Detection Strategies

Enable and review SharePoint audit logs for privilege changes, group membership modifications, and site collection administrator additions.
Correlate IIS access logs with authenticated user activity to identify unusual request patterns targeting REST or SOAP endpoints.
Alert on repeated HTTP 200 responses to endpoints that historically return HTTP 401 or HTTP 403 for the same user.

Monitoring Recommendations

Forward SharePoint ULS logs, IIS logs, and Windows Security events to a centralized SIEM for correlation.
Baseline normal administrative activity and alert on deviations, particularly outside business hours.
Monitor Active Directory for privilege changes on SharePoint service accounts and farm administrators.

How to Mitigate CVE-2026-58277

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-58277 to all affected SharePoint Server 2016 and 2019 farms.
Audit SharePoint site collection administrators, farm administrators, and privileged group memberships for unauthorized additions.
Rotate credentials for any SharePoint account suspected of compromise, prioritizing service and admin accounts.

Patch Information

Microsoft has released security updates addressing CVE-2026-58277 for SharePoint Server 2016 and SharePoint Server 2019. Administrators should install the updates listed in the Microsoft Security Update Guide using standard SharePoint patching procedures, including running the SharePoint Products Configuration Wizard on each farm server after installation.

Workarounds

Restrict SharePoint access to trusted internal networks or VPN users where public exposure is not required.
Enforce multi-factor authentication for all SharePoint users to reduce the risk of credential-based abuse.
Apply the principle of least privilege to SharePoint permissions, removing unnecessary contribute or design rights from standard users.
Disable anonymous access on all web applications and site collections until patches are applied.

bash

# Verify SharePoint patch level on the farm
Get-SPFarm | Select-Object BuildVersion
Get-SPProduct -Local | Select-Object ProductName, PatchableUnitDisplayName, PatchState

# List site collection administrators for review
Get-SPSite -Limit All | ForEach-Object {
    Get-SPSiteAdministration -Identity $_.Url |
        Select-Object Url, @{n='Admins';e={($_.Owner + ';' + $_.SecondaryContact)}}
}