CVE-2026-70202: Microsoft SharePoint Server SSRF Vulnerability

CVE-2026-70202 Overview

CVE-2026-70202 is a Server-Side Request Forgery (SSRF) vulnerability in Microsoft Office SharePoint that allows an authenticated attacker to elevate privileges over a network. The flaw is tracked under CWE-918: Server-Side Request Forgery and affects Microsoft SharePoint Server subscription edition. An attacker with low-level privileges can coerce the SharePoint Server into issuing requests to attacker-chosen destinations, abusing the server's trust context to reach internal resources or escalate access.

Critical Impact
An authorized attacker can abuse SSRF behavior in SharePoint Server to elevate privileges across the network, with high impact to confidentiality, integrity, and availability.

Affected Products

Microsoft SharePoint Server (Subscription Edition)
Deployments exposing SharePoint endpoints to authenticated users on the network
Hybrid SharePoint environments integrating on-premises servers with cloud identity

Discovery Timeline

2026-10-13 - CVE-2026-70202 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-70202

Vulnerability Analysis

The vulnerability resides in how SharePoint Server processes user-controllable input that influences outbound requests. An authenticated attacker can craft input causing the server to initiate HTTP or protocol-level requests to destinations the attacker specifies. Because the request originates from the SharePoint Server itself, it inherits the server's network position and service identity.

Successful exploitation yields privilege escalation across a network boundary. The confidentiality, integrity, and availability impacts are all rated high, reflecting the ability to reach internal services, retrieve sensitive responses, and manipulate downstream components. Attack complexity is high, indicating that specific preconditions or timing may be required to reliably trigger the behavior.

Root Cause

The root cause is insufficient validation of destinations used by server-side request logic within SharePoint. The server does not adequately restrict request targets, URL schemes, or redirect behavior, allowing attacker-supplied values to drive outbound connections. This matches the CWE-918 pattern where a web application fetches a remote resource without validating the user-supplied URL.

Attack Vector

Exploitation requires network access to SharePoint and valid low-privilege credentials. The attacker submits a request that embeds a crafted URL or identifier. SharePoint processes the input and issues the outbound request on the attacker's behalf. The attacker uses this primitive to reach internal endpoints, read responses, or interact with privileged services that trust the SharePoint host.

No public proof-of-concept exploit is listed in NVD at publication time, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. Microsoft has published guidance in the Microsoft Security Update Guide.

Detection Methods for CVE-2026-70202

Indicators of Compromise

Unexpected outbound HTTP, HTTPS, or non-standard protocol connections originating from SharePoint Server application pool identities.
SharePoint IIS logs containing requests with URL parameters pointing to internal RFC1918 addresses, loopback, or cloud metadata endpoints.
Authenticated user activity followed by anomalous server-initiated requests within short time windows.

Detection Strategies

Inspect SharePoint ULS and IIS logs for request handlers accepting URL-like parameters and correlate with outbound socket activity from w3wp.exe.
Deploy egress filtering alerts that flag SharePoint hosts contacting internal management interfaces, metadata services, or unexpected external domains.
Hunt for low-privileged accounts issuing requests immediately before unusual server-side network activity.

Monitoring Recommendations

Baseline normal outbound destinations for SharePoint servers and alert on deviations.
Enable detailed authentication and request logging on SharePoint front-ends and forward to a centralized analytics platform.
Monitor for enumeration patterns consistent with SSRF reconnaissance, such as sequential internal IP probes.

How to Mitigate CVE-2026-70202

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update Guide for SharePoint Server Subscription Edition.
Inventory all SharePoint Server instances and prioritize patching for internet-exposed or multi-tenant deployments.
Review SharePoint service account privileges and reduce network reachability to sensitive internal services.

Patch Information

Microsoft has issued guidance and updates through the Microsoft Security Response Center. Administrators should consult the Microsoft Security Update Guide for CVE-2026-70202 for build numbers, prerequisites, and installation instructions specific to their SharePoint Server version.

Workarounds

Restrict outbound network connectivity from SharePoint Server hosts to only required destinations using host and perimeter firewalls.
Enforce least-privilege on SharePoint application pool and service accounts to limit the blast radius of SSRF-driven requests.
Require strong authentication and limit which users can access features that accept URL or resource identifiers until the patch is deployed.

bash

# Configuration example: restrict SharePoint outbound traffic with Windows Firewall
New-NetFirewallRule -DisplayName "Block SharePoint Outbound to Internal Mgmt" `
  -Direction Outbound `
  -Program "C:\Windows\System32\inetsrv\w3wp.exe" `
  -RemoteAddress 169.254.169.254,10.0.0.0/8 `
  -Action Block