CVE-2026-70267: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-70267 Overview

CVE-2026-70267 is a remote code execution vulnerability in Microsoft Office SharePoint Server. The flaw stems from inclusion of functionality from an untrusted control sphere, tracked as [CWE-829]. An authorized attacker with high privileges can execute arbitrary code on an affected SharePoint Server instance over the network. Exploitation requires no user interaction and succeeds with low attack complexity, giving the attacker full compromise of confidentiality, integrity, and availability on the targeted system.

Critical Impact
An authenticated attacker with elevated SharePoint privileges can achieve remote code execution on the server, pivoting from a privileged account into full control of SharePoint content, service accounts, and connected data stores.

Affected Products

Microsoft SharePoint Server (Subscription Edition)
SharePoint farms exposing authenticated administrative or content endpoints
Downstream services and workloads integrated with SharePoint through service accounts

Discovery Timeline

2026-10-13 - CVE-2026-70267 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-70267

Vulnerability Analysis

The vulnerability resides in SharePoint Server code that incorporates functionality sourced from an untrusted control sphere. SharePoint loads or references executable logic without sufficient validation of its origin or integrity. An authorized attacker who holds high privileges within the SharePoint environment can abuse this behavior to introduce attacker-controlled logic into a trusted execution context.

Successful exploitation yields remote code execution under the identity of the SharePoint worker process. From that foothold, an attacker can harvest service account credentials, modify site content, access connected SQL back ends, and move laterally into Active Directory and adjacent Microsoft 365 integrations.

Root Cause

The root cause is classified as [CWE-829]: Inclusion of Functionality from Untrusted Control Sphere. SharePoint resolves or imports functionality from a location an authenticated privileged user can influence. Because the server trusts that functionality during execution, attacker-supplied code or references run inside the SharePoint process context without the isolation expected of untrusted input.

Attack Vector

The attack vector is network based. An attacker authenticates to SharePoint with high privileges, then sends crafted requests that cause the server to include and execute untrusted functionality. No user interaction is required. Because the scope is unchanged, the attacker inherits the privileges of the SharePoint application pool identity rather than crossing a trust boundary into the host OS directly, though lateral movement is practical from that position.

No public proof-of-concept exploit is listed in the available references. See the Microsoft Security Update CVE-2026-70267 advisory for technical details.

Detection Methods for CVE-2026-70267

Indicators of Compromise

Unexpected child processes spawned by w3wp.exe running under SharePoint application pool identities, especially cmd.exe, powershell.exe, or script hosts.
New or modified assemblies, web parts, or feature definitions in SharePoint hive directories under %ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions.
Outbound network connections from SharePoint front-end servers to unfamiliar hosts shortly after authenticated administrative requests.
SharePoint ULS log entries referencing deployment, feature activation, or solution package operations from non-standard administrators.

Detection Strategies

Baseline the expected process tree for w3wp.exe on SharePoint servers and alert on deviations.
Correlate privileged SharePoint administrative actions in ULS logs with endpoint telemetry on the same host.
Monitor for additions to the Global Assembly Cache and SharePoint solution store that occur outside sanctioned change windows.

Monitoring Recommendations

Forward SharePoint ULS, IIS, and Windows Security logs into a centralized analytics pipeline for correlation.
Enable PowerShell script block logging and command-line auditing on all SharePoint servers.
Track authentication events for farm, service, and site collection administrators and alert on new or dormant accounts becoming active.

How to Mitigate CVE-2026-70267

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-70267 to all SharePoint Server Subscription Edition farms.
Audit SharePoint farm, service application, and site collection administrator accounts and remove unnecessary high-privilege access.
Rotate credentials for SharePoint service accounts and managed accounts if compromise is suspected.
Review recent solution deployments, feature activations, and custom code additions for unauthorized changes.

Patch Information

Microsoft has released a security update for Microsoft SharePoint Server addressing CVE-2026-70267. Administrators should consult the Microsoft Security Update CVE-2026-70267 guide for the specific build numbers, prerequisites, and deployment steps for their SharePoint version.

Workarounds

Restrict farm and site collection administrator privileges to a minimal, audited set of accounts protected by multi-factor authentication.
Place SharePoint administrative endpoints behind network segmentation or VPN access to limit exposure of authenticated attack surface.
Enforce application allowlisting on SharePoint servers so that unexpected binaries launched by w3wp.exe are blocked.
Disable or tightly control SharePoint capabilities that permit uploading solutions, apps, or custom code from untrusted sources.

bash

# Example: enumerate SharePoint farm administrators for review
Add-PSSnapin Microsoft.SharePoint.PowerShell
Get-SPFarm | Select-Object -ExpandProperty CurrentUserIsAdministrator
(Get-SPWebApplication -IncludeCentralAdministration | Where-Object {$_.IsAdministrationWebApplication}).Sites[0].RootWeb.SiteAdministrators