CVE-2026-62837 Overview
CVE-2026-62837 is a relative path traversal vulnerability in Microsoft Office SharePoint Server. An authorized attacker can exploit the flaw over a network to disclose information stored outside the intended access boundary. The weakness is classified under CWE-23: Relative Path Traversal. Exploitation requires low privileges and no user interaction, and impacts confidentiality without affecting integrity or availability. Microsoft published the advisory on August 11, 2026.
Critical Impact
An authenticated attacker can traverse relative paths in SharePoint Server to read files outside the permitted directory scope, resulting in unauthorized disclosure of sensitive content over the network.
Affected Products
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2016 Enterprise
- Microsoft SharePoint Server 2019
Discovery Timeline
- 2026-08-11 - CVE-2026-62837 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-62837
Vulnerability Analysis
The vulnerability resides in how SharePoint Server resolves user-supplied resource paths. The server accepts relative path sequences without adequately normalizing or validating them against a canonical root. An authenticated attacker can craft requests containing traversal sequences such as ..\ or ../ to reach files outside the intended web application scope. Successful exploitation returns file contents to the attacker over an authenticated network session. The impact is limited to confidentiality; the flaw does not permit modification of data or disruption of service. SharePoint's rich content model, which stores configuration, credentials, and site data across multiple directories, increases the sensitivity of files reachable through this weakness.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory, tracked as CWE-23. SharePoint's request handler resolves file references before enforcing containment checks. When the resolved path escapes the intended directory, the handler still serves the file to the caller, provided the attacker holds a valid low-privilege account.
Attack Vector
The attack originates over the network against a SharePoint web endpoint. The attacker must authenticate with a low-privilege account, then submit a request containing traversal sequences in a parameter that references a server-side resource. No user interaction is required, and the scope of the compromised component remains unchanged. See the Microsoft Security Update CVE-2026-62837 advisory for endpoint-specific details.
No verified public exploitation code is available for this issue. The vulnerability mechanism is documented in the vendor advisory.
Detection Methods for CVE-2026-62837
Indicators of Compromise
- HTTP requests to SharePoint endpoints containing encoded or literal traversal sequences such as ..%2f, ..%5c, ../, or ..\.
- Authenticated sessions from low-privilege accounts accessing file-serving handlers outside their normal usage pattern.
- IIS logs showing successful 200 responses to requests referencing unexpected file paths or extensions.
Detection Strategies
- Inspect IIS and SharePoint ULS logs for URI parameters containing .., %2e%2e, or mixed-case encoded variants.
- Correlate authenticated user identity with the volume and diversity of file paths requested, flagging outliers.
- Deploy web application firewall rules that block requests with traversal patterns targeting SharePoint layouts and API paths.
Monitoring Recommendations
- Forward IIS, SharePoint ULS, and Windows security logs to a centralized analytics platform for behavioral baselining.
- Alert on authenticated read access to sensitive SharePoint hive files, configuration directories, and web.config artifacts.
- Track EPSS movement for CVE-2026-62837 and adjust detection priority as exploitability data changes.
How to Mitigate CVE-2026-62837
Immediate Actions Required
- Apply the security update referenced in the Microsoft Security Update CVE-2026-62837 advisory to all affected SharePoint Server instances.
- Audit SharePoint user accounts and revoke unused low-privilege access to reduce the pool of potential attackers.
- Review authentication logs for anomalous access from service accounts or dormant identities in the weeks preceding patch deployment.
Patch Information
Microsoft has issued patches for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Administrators should consult the Microsoft Security Update Guide for build numbers, prerequisites, and installation guidance specific to each supported edition.
Workarounds
- Restrict network access to SharePoint web front-ends using firewall rules or VPN gating until patches are validated in production.
- Enforce least-privilege permissions on SharePoint sites, libraries, and file shares to constrain data reachable by any single compromised account.
- Deploy WAF signatures that block path traversal payloads targeting SharePoint endpoints as a compensating control before patching.
# Example WAF rule pattern to block traversal sequences targeting SharePoint
SecRule REQUEST_URI "@rx (\.\.[\\/]|%2e%2e[\\/%]|%252e%252e)" \
"id:1062837,phase:1,deny,status:403,\
msg:'CVE-2026-62837 SharePoint path traversal attempt',\
tag:'CWE-23'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
