CVE-2026-69904 Overview
CVE-2026-69904 is a Server-Side Request Forgery (SSRF) vulnerability in Microsoft Office SharePoint Server. An authenticated attacker can coerce the SharePoint server into making unintended outbound requests, resulting in disclosure of information over a network. The flaw is tracked under CWE-918: Server-Side Request Forgery and affects the subscription edition of microsoft:sharepoint_server. Exploitation requires low privileges and user interaction, which limits practical impact. Microsoft published the advisory on 2026-09-08 through the Microsoft Security Update Guide.
Critical Impact
Authenticated attackers can trigger server-initiated requests from SharePoint to disclose information reachable from the server, including internal-only services.
Affected Products
- Microsoft SharePoint Server Subscription Edition
- Deployments exposing SharePoint web front-ends to authenticated users
- Hybrid SharePoint farms with outbound network reachability to internal services
Discovery Timeline
- 2026-09-08 - CVE-2026-69904 published to NVD
- 2026-09-08 - Microsoft publishes advisory in the Security Update Guide
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-69904
Vulnerability Analysis
The vulnerability resides in SharePoint Server functionality that accepts user-supplied URLs or resource references and issues outbound network requests on behalf of the server. Insufficient validation of the destination allows an authorized user to redirect these requests toward attacker-chosen endpoints. Because the requests originate from the SharePoint server, they can traverse trust boundaries that external attackers cannot reach directly.
The scope is unchanged and impact is limited to information disclosure. Confidentiality of resources reachable from the SharePoint host is at risk, while integrity and availability remain intact. Exploitation requires the attacker to hold a valid SharePoint account and to induce a legitimate user to perform an action such as opening a crafted link or view.
Successful abuse of SSRF in enterprise SharePoint environments often enables enumeration of internal HTTP services, retrieval of cloud metadata endpoints, and probing of segmented network zones. The disclosed data can then support lateral movement or targeted follow-on attacks.
Root Cause
The root cause is improper validation of a URL or hostname before SharePoint issues an outbound request. The server does not adequately restrict the request target to an allowlisted set of destinations, allowing internal or metadata addresses to be reached.
Attack Vector
The attack vector is network-based and requires authentication plus user interaction. An attacker with a low-privileged SharePoint account crafts a request or content object that causes the server to fetch a URL under attacker control. When the target user interacts with the crafted content, SharePoint issues the request and returns response data that discloses information from otherwise inaccessible network locations.
No public proof-of-concept, exploit code, or CISA KEV listing has been published for CVE-2026-69904 at the time of writing.
Detection Methods for CVE-2026-69904
Indicators of Compromise
- Outbound HTTP or HTTPS requests from SharePoint server processes (w3wp.exe) to internal-only IP ranges or cloud metadata addresses such as 169.254.169.254.
- SharePoint ULS log entries showing unexpected URL fetch operations initiated by low-privileged user accounts.
- Repeated failed or redirected outbound requests originating from SharePoint web front-end servers to non-standard ports.
Detection Strategies
- Baseline legitimate outbound destinations for SharePoint servers and alert on requests to RFC1918 ranges, link-local addresses, or unapproved hosts.
- Correlate SharePoint authentication events with outbound network flows to identify low-privileged users triggering unusual server-side fetches.
- Inspect HTTP request headers on outbound traffic for SharePoint user-agent strings targeting internal services.
Monitoring Recommendations
- Forward SharePoint ULS logs, IIS logs, and network flow data to a centralized analytics platform for correlation.
- Monitor cloud metadata endpoint access from any SharePoint-hosting virtual machine and treat any hit as high priority.
- Track new or modified SharePoint list items, web parts, or workflows that reference external URL parameters.
How to Mitigate CVE-2026-69904
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-69904.
- Inventory SharePoint Server Subscription Edition deployments and prioritize internet-adjacent farms for patching.
- Review recent SharePoint account activity for signs of low-privileged users triggering server-side fetches.
Patch Information
Microsoft addresses CVE-2026-69904 through its regular update channel for SharePoint Server Subscription Edition. Refer to the Microsoft Security Update Guide for the current patch package, version identifiers, and installation prerequisites for each supported build.
Workarounds
- Restrict outbound network access from SharePoint servers to an allowlist of required destinations using host or network firewalls.
- Block SharePoint server access to cloud metadata endpoints and internal management interfaces at the network layer.
- Enforce least privilege on SharePoint accounts and disable self-service site creation for untrusted users until patches are deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.