CVE-2026-62839: SharePoint Server Auth Bypass Vulnerability

CVE-2026-62839 Overview

CVE-2026-62839 is a credential protection weakness in Microsoft Office SharePoint. The flaw allows an authorized attacker to perform spoofing over a network by leveraging insufficiently protected credentials. The vulnerability is categorized under [CWE-522] Insufficiently Protected Credentials.

Microsoft published the advisory on August 11, 2026. The issue affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Successful exploitation requires the attacker to hold valid authenticated access to the SharePoint environment before targeting exposed credential material.

Critical Impact
An authenticated attacker can extract credential data from SharePoint and reuse it to impersonate other users or services across the network, enabling lateral movement within collaboration environments.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016

Discovery Timeline

2026-08-11 - CVE-2026-62839 published to NVD and Microsoft Security Update Guide
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-62839

Vulnerability Analysis

The vulnerability stems from SharePoint's handling of credential material stored or transmitted by the application. An authenticated user with low privileges can access credential data that should remain restricted. The exposed credentials permit the attacker to spoof another identity when interacting with SharePoint or downstream services.

Because the attack vector is network-based and requires only low privileges without user interaction, any authenticated account within a SharePoint tenant becomes a viable launch point. The impact is limited to confidentiality of credential data, but the follow-on spoofing capability can expand access within the environment.

EPSS currently rates the exploit probability at 0.577% with a percentile of 44.6, indicating moderate but not immediate risk of active exploitation.

Root Cause

The root cause is insufficient protection of credentials, mapped to [CWE-522]. SharePoint stores or transmits credential material in a manner that permits an authorized user to retrieve it without appropriate access controls or cryptographic protection. Microsoft's advisory does not disclose the specific storage location or protocol path involved.

Attack Vector

The attacker must first authenticate to the SharePoint server with valid low-privilege credentials. Once inside, the attacker queries the affected component to recover protected credential material. Those recovered credentials are then replayed against SharePoint or connected systems to spoof a different identity. No user interaction is required during exploitation.

No public proof-of-concept code or exploit is currently available for CVE-2026-62839. See the Microsoft Security Update CVE-2026-62839 advisory for vendor-supplied technical guidance.

Detection Methods for CVE-2026-62839

Indicators of Compromise

Authenticated SharePoint sessions accessing credential-bearing endpoints or configuration objects outside their normal scope
Successful authentication events on SharePoint or federated services using accounts from unexpected source hosts shortly after low-privilege SharePoint activity
Unusual read operations against SharePoint secure store or managed account configuration by non-administrative users

Detection Strategies

Correlate SharePoint ULS and IIS logs to identify low-privilege accounts issuing requests against administrative or credential-related endpoints
Baseline typical SharePoint API usage per user role and alert on deviations that touch credential storage components
Monitor Windows Security event logs for logon events (4624, 4648) that follow anomalous SharePoint activity and originate from atypical hosts

Monitoring Recommendations

Enable verbose auditing on the SharePoint Secure Store Service and Managed Accounts configuration
Forward SharePoint, IIS, and Windows Security logs to a centralized analytics platform for cross-correlation
Alert on service account usage from hosts that do not match documented service topology

How to Mitigate CVE-2026-62839

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for all affected SharePoint Server versions
Rotate any service account, managed account, or secure store credentials that may have been accessible on unpatched servers
Review SharePoint audit logs for anomalous access to credential-bearing components prior to patch deployment

Patch Information

Microsoft has released security updates for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Administrators should reference the Microsoft Security Update CVE-2026-62839 advisory for the specific build numbers and installation guidance corresponding to each supported version.

Workarounds

Restrict SharePoint access to trusted, authenticated users and reduce standing low-privilege accounts where possible
Enforce network segmentation so SharePoint servers cannot be reached directly from general user workstation subnets
Enable multi-factor authentication on all accounts with SharePoint access to raise the cost of credential reuse

bash

# Verify installed SharePoint patch level on a target server
Get-SPProduct | Select-Object ProductName, PatchName, Version

# List recent authentication events that may indicate credential replay
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4648} -MaxEvents 200 |
  Where-Object { $_.Properties[5].Value -notlike '*$' } |
  Format-Table TimeCreated, Id, @{n='Account';e={$_.Properties[5].Value}}, @{n='Source';e={$_.Properties[18].Value}}