CVE-2026-64921: SharePoint Server Privilege Escalation Flaw

CVE-2026-64921 Overview

CVE-2026-64921 is a missing authentication vulnerability in Microsoft Office SharePoint. The flaw allows an authorized attacker to elevate privileges over a network by invoking a critical function that fails to enforce authentication checks. Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise are affected. The weakness maps to [CWE-306] Missing Authentication for Critical Function. Microsoft published the vulnerability through its Security Response Center on August 11, 2026.

Critical Impact
An authenticated attacker with low privileges on a SharePoint server can elevate to higher privileges across the network, compromising confidentiality, integrity, and availability of collaboration data.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2026-08-11 - Microsoft releases security update for CVE-2026-64921
2026-08-11 - CVE-2026-64921 published to the National Vulnerability Database
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-64921

Vulnerability Analysis

CVE-2026-64921 exists in a SharePoint server component that exposes a security-relevant function without verifying the caller's authentication state or privilege level. An attacker who already holds low-privilege credentials on the SharePoint deployment can invoke this function remotely across the network. Successful exploitation grants elevated privileges within the SharePoint environment. The vulnerability requires no user interaction and low attack complexity, making it well-suited for post-authentication lateral movement inside enterprise Microsoft 365 hybrid deployments.

Root Cause

The root cause is Missing Authentication for Critical Function [CWE-306]. A SharePoint server-side endpoint or handler performs a privileged operation without confirming that the requesting principal is authorized to invoke it. Microsoft has not published component-level technical details beyond the advisory reference. Refer to the Microsoft Security Update CVE-2026-64921 advisory for authoritative guidance.

Attack Vector

The attack vector is network-based. An attacker authenticated to SharePoint at a low privilege level sends a crafted request to the vulnerable function over HTTP or HTTPS. Because the function bypasses authorization enforcement, the attacker's request is processed with elevated context. This enables privilege escalation to a role capable of reading, modifying, or destroying SharePoint content and configuration. No verified public proof-of-concept exploit code is available at this time.

Detection Methods for CVE-2026-64921

Indicators of Compromise

Unexpected privilege changes on SharePoint accounts, including additions to site collection administrator or farm administrator groups.
Anomalous HTTP requests to SharePoint web services or administrative endpoints originating from standard user sessions.
Creation or modification of SharePoint solutions, features, or timer jobs by non-administrative accounts.

Detection Strategies

Monitor SharePoint ULS logs and IIS access logs for requests to administrative endpoints issued by low-privilege authenticated users.
Correlate Windows Event Log privilege assignment events on SharePoint servers with SharePoint audit log role changes.
Alert on outbound authentication attempts from SharePoint service accounts to unusual destinations following suspicious web requests.

Monitoring Recommendations

Enable SharePoint audit logging for security group changes, permission modifications, and administrative actions across all site collections.
Forward SharePoint ULS, IIS, and Windows Security logs to a centralized analytics platform for correlation.
Baseline normal request patterns to SharePoint administrative URLs and alert on deviations from that baseline.

How to Mitigate CVE-2026-64921

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-64921 advisory to all affected SharePoint Server versions.
Audit SharePoint farm administrator and site collection administrator memberships and remove unnecessary privileged accounts.
Rotate credentials for SharePoint service accounts and any accounts with recent unexplained privilege changes.

Patch Information

Microsoft has released security updates for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. Administrators should install the updates through Microsoft Update, WSUS, or the SharePoint patch package linked from the Microsoft Security Update CVE-2026-64921 advisory. Run the SharePoint Products Configuration Wizard or PSConfig after patch installation to complete the upgrade.

Workarounds

Restrict network access to SharePoint web front ends so that only trusted client subnets can reach authenticated endpoints.
Enforce least privilege on SharePoint user accounts; remove standing contributor or higher permissions where read access is sufficient.
Require multifactor authentication for all SharePoint access to raise the cost of the low-privilege authentication precondition.

bash

# Post-patch verification on a SharePoint server
Get-SPProduct -Local | Select-Object ProductName, PatchableUnitDisplayName, Patches
PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install