CVE-2026-70324 Overview
CVE-2026-70324 is a Server-Side Request Forgery (SSRF) vulnerability in Microsoft Office SharePoint that allows an authenticated attacker to elevate privileges over a network. The flaw is tracked under CWE-918 and affects supported SharePoint Server editions. An attacker with low privileges can coerce the SharePoint server into issuing crafted requests to internal resources, resulting in high confidentiality, integrity, and availability impact.
Critical Impact
An authenticated attacker can abuse SharePoint's server-side request handling to reach internal services and escalate privileges across the network.
Affected Products
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2016 Enterprise
- Microsoft SharePoint Server 2019
Discovery Timeline
- 2026-08-11 - CVE-2026-70324 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-70324
Vulnerability Analysis
The vulnerability resides in a SharePoint Server component that accepts a user-controlled URL or resource identifier and issues an outbound request without adequate destination validation. Because SharePoint executes the request from a trusted position inside the corporate perimeter, the attacker can reach services that are not exposed externally. Successful exploitation leads to privilege elevation across the network, with high impact to confidentiality, integrity, and availability.
Exploitation requires network access and valid low-privilege authentication to the SharePoint site. User interaction is not required, and attack complexity is low, making authenticated internal users and compromised low-tier accounts realistic threat sources.
Root Cause
The root cause is insufficient validation of destination URLs processed by SharePoint's request-issuing logic, classified as CWE-918: Server-Side Request Forgery. The server does not enforce an allowlist of permitted hosts or block requests to loopback, link-local, and internal-only endpoints. This lets an attacker pivot through the SharePoint service identity to reach resources the attacker cannot address directly.
Attack Vector
An authenticated attacker submits a crafted request to a vulnerable SharePoint endpoint containing an attacker-controlled URL. SharePoint fetches or interacts with the target on the attacker's behalf using the service account's context. The response, side effects, or authentication tokens can then be leveraged to access privileged internal resources such as metadata services, management APIs, or adjacent SharePoint components. See the Microsoft Security Update Guide for vendor-supplied technical details.
Detection Methods for CVE-2026-70324
Indicators of Compromise
- Outbound HTTP or HTTPS requests originating from SharePoint worker processes (w3wp.exe) targeting loopback, link-local (169.254.169.254), or internal management addresses.
- SharePoint IIS logs showing repeated POST or GET requests to endpoints that accept URL parameters, especially with encoded or obfuscated hostnames.
- Unusual authentication events for the SharePoint service account against internal services shortly after user-driven web requests.
Detection Strategies
- Correlate IIS access logs with process-level network telemetry from the SharePoint host to identify request patterns where user input maps to outbound connections.
- Hunt for w3wp.exe connecting to non-standard internal IP ranges or cloud metadata endpoints, which SharePoint should never contact.
- Review SharePoint ULS logs for exceptions in URL parsing or HTTP client components tied to user-supplied parameters.
Monitoring Recommendations
- Enable detailed IIS logging with request bodies where policy allows and forward logs to a centralized analytics platform for long-term hunting.
- Monitor egress from SharePoint servers with strict segmentation rules and alert on any deviation from the expected destination set.
- Track privilege changes and access to sensitive site collections that occur in temporal proximity to suspicious outbound requests.
How to Mitigate CVE-2026-70324
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-70324 to all affected SharePoint Server instances.
- Inventory SharePoint Server 2016, 2019, and Subscription Edition deployments and prioritize internet-adjacent and multi-tenant farms.
- Rotate credentials and secrets accessible to the SharePoint service account if compromise is suspected.
Patch Information
Microsoft has published a security update through the Microsoft Security Update Guide. Administrators should deploy the update using their standard SharePoint patching process, run the SharePoint Products Configuration Wizard on each server in the farm, and verify build numbers post-installation.
Workarounds
- Restrict SharePoint outbound network access using host firewalls or network segmentation, blocking connections to loopback, link-local, and internal management ranges from w3wp.exe.
- Require least-privilege authentication and remove unnecessary low-tier accounts from SharePoint sites to reduce the pool of potential authenticated attackers.
- Place SharePoint behind a reverse proxy or web application firewall configured to inspect and block requests containing suspicious URL parameters.
# Example: restrict outbound traffic from SharePoint worker process using Windows Firewall
New-NetFirewallRule -DisplayName "Block SharePoint w3wp SSRF metadata" `
-Direction Outbound `
-Program "C:\Windows\System32\inetsrv\w3wp.exe" `
-RemoteAddress 169.254.169.254,127.0.0.1 `
-Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
