CVE-2026-58639: Microsoft SharePoint Server SSRF Vulnerability

CVE-2026-58639 Overview

CVE-2026-58639 is a Server-Side Request Forgery (SSRF) vulnerability in Microsoft Office SharePoint Server. An authorized attacker can leverage the flaw to perform spoofing over a network by coercing the SharePoint server to issue requests to unintended destinations. The vulnerability is tracked under CWE-918: Server-Side Request Forgery and impacts SharePoint Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise.

Critical Impact
An authenticated attacker with low privileges can abuse SharePoint to send crafted requests to internal or external resources, enabling spoofing and exposure of confidential data reachable from the server.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2026-08-11 - CVE-2026-58639 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-58639

Vulnerability Analysis

The vulnerability resides in how Microsoft SharePoint Server validates and processes URLs used for outbound HTTP requests. An authenticated attacker submits a crafted request that causes the SharePoint web application to fetch a resource specified by the attacker. Because the request originates from the SharePoint server, it inherits the server's network position and identity, enabling spoofing scenarios against downstream services.

According to EPSS data published on 2026-08-13, CVE-2026-58639 carries an exploit probability of 0.769%. The scoring reflects network-based exploitation requiring low privileges and no user interaction, with a confidentiality impact on the affected component.

Root Cause

The root cause is insufficient validation of user-supplied URLs or resource identifiers passed to SharePoint components that perform server-side HTTP fetches. Without strict allow-listing of destinations and validation of resolved addresses, SharePoint issues requests to attacker-controlled targets or to internal-only endpoints that should not be reachable from an external client context.

Attack Vector

Exploitation requires network access to the SharePoint web interface and authenticated access with low privileges (PR:L). An attacker submits a request containing a manipulated URL to a SharePoint feature that performs server-side fetching. SharePoint then dispatches the request on behalf of the attacker, allowing spoofing of the request origin toward internal services, cloud metadata endpoints, or external systems that trust the SharePoint server's identity.

No public proof-of-concept or exploit code has been published for CVE-2026-58639 at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update CVE-2026-58639 advisory for vendor-specific technical detail.

Detection Methods for CVE-2026-58639

Indicators of Compromise

Outbound HTTP or HTTPS connections originating from SharePoint worker processes (w3wp.exe) to unusual internal IP ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254.
SharePoint ULS logs containing unexpected URL parameters referencing internal hostnames, private IP addresses, or non-standard schemes.
Anomalous authenticated requests to SharePoint endpoints that accept URL or URI parameters, especially from accounts with minimal historical activity.

Detection Strategies

Monitor IIS and SharePoint request logs for HTTP parameters containing URL values pointing to internal resources or to atypical external hosts.
Correlate authenticated SharePoint sessions with subsequent outbound network flows to detect server-initiated requests that do not match legitimate integration patterns.
Baseline normal outbound destinations from SharePoint servers and alert on deviations, particularly to metadata services, administrative interfaces, or newly observed domains.

Monitoring Recommendations

Enable verbose ULS logging for SharePoint components that perform outbound fetches and forward logs to a centralized analytics platform.
Instrument host-based telemetry on SharePoint servers to capture process-to-network mappings for w3wp.exe and related SharePoint services.
Review authentication logs for low-privilege accounts issuing requests to SharePoint endpoints that historically require elevated activity.

How to Mitigate CVE-2026-58639

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update CVE-2026-58639 advisory to all affected SharePoint Server deployments.
Inventory SharePoint Server 2016 Enterprise, SharePoint Server 2019, and SharePoint Subscription Edition instances and prioritize patching of internet-reachable servers.
Review authenticated user access to SharePoint and revoke unnecessary accounts that could be leveraged to meet the PR:L exploitation prerequisite.

Patch Information

Microsoft has published a security update for CVE-2026-58639 via the Microsoft Security Response Center. Administrators should consult the Microsoft Security Update CVE-2026-58639 page for build numbers, KB articles, and installation instructions matching each affected SharePoint edition.

Workarounds

Restrict outbound network access from SharePoint servers using host firewalls or egress filtering, blocking traffic to cloud metadata endpoints and internal management interfaces.
Enforce network segmentation so SharePoint servers cannot reach sensitive internal services that would otherwise trust their identity.
Limit SharePoint account provisioning and require multi-factor authentication to raise the bar for attackers seeking the authenticated access required for exploitation.

bash

# Configuration example: restrict SharePoint server egress to metadata endpoint on Windows
New-NetFirewallRule -DisplayName "Block SharePoint egress to IMDS" `
  -Direction Outbound `
  -RemoteAddress 169.254.169.254 `
  -Action Block `
  -Program "C:\Windows\System32\inetsrv\w3wp.exe"