CVE-2026-70326: Microsoft SharePoint Server SSRF Vulnerability

CVE-2026-70326 Overview

CVE-2026-70326 is a Server-Side Request Forgery (SSRF) vulnerability in Microsoft Office SharePoint Server. An authorized attacker can abuse SharePoint to issue crafted requests from the server, reaching internal resources and elevating privileges over the network. The flaw is tracked under CWE-918: Server-Side Request Forgery.

Microsoft published the advisory on August 11, 2026, and the record was last updated on August 13, 2026. The vulnerability affects Microsoft SharePoint Server (Subscription Edition) and is documented in the Microsoft CVE-2026-70326 Advisory.

Critical Impact
An authenticated attacker with low privileges can coerce SharePoint into making server-side requests, leading to privilege escalation with impact to confidentiality, integrity, and availability.

Affected Products

Microsoft SharePoint Server (Subscription Edition)
cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*
Deployments exposing SharePoint web front-ends to authenticated users on the network

Discovery Timeline

2026-08-11 - CVE-2026-70326 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-70326

Vulnerability Analysis

The vulnerability is a Server-Side Request Forgery flaw within Microsoft Office SharePoint Server. SharePoint accepts user-controlled input that is subsequently used to construct outbound HTTP requests from the server. Because input validation on the target URL or resource identifier is insufficient, an authenticated attacker can redirect those requests to arbitrary hosts, including internal management endpoints not reachable from the public network.

SSRF in SharePoint is impactful because the server frequently holds machine account credentials, service tokens, and integration secrets used to talk to Active Directory, Exchange, and other back-end services. When the vulnerable request path executes under a privileged context, an attacker can pivot from a low-privileged SharePoint account to higher-privileged operations within the collaboration environment.

Root Cause

The root cause is improper validation of URLs or hostnames supplied to a SharePoint feature that performs outbound requests. SharePoint fails to enforce an allowlist or restrict destinations to trusted hosts. This lets the attacker specify internal IP ranges, loopback addresses, or metadata endpoints. The weakness is classified as [CWE-918].

Attack Vector

Exploitation requires network access to a SharePoint web endpoint and valid low-privilege credentials. The attacker submits a request containing a crafted URL parameter. SharePoint issues the outbound call using its own identity, returning data or triggering state changes on the internal target. No user interaction is required. According to the current EPSS data (0.589%, 45th percentile) exploitation is not yet widespread, and no public proof-of-concept has been reported.

See the Microsoft CVE-2026-70326 Advisory for vendor-specific technical detail.

Detection Methods for CVE-2026-70326

Indicators of Compromise

Outbound HTTP requests originating from the SharePoint application pool identity toward internal IP ranges, 127.0.0.1, or cloud metadata addresses such as 169.254.169.254.
Unusual authenticated SharePoint requests containing URL parameters that reference internal hostnames, private RFC1918 addresses, or non-standard schemes.
IIS logs showing repeated requests to SharePoint handlers followed by anomalous DNS lookups from the SharePoint server.

Detection Strategies

Monitor IIS and SharePoint ULS logs for parameters carrying full URLs or hostnames destined for internal ranges.
Correlate low-privileged SharePoint user sessions with outbound HTTP or SMB activity from the SharePoint host.
Alert on new egress destinations from SharePoint servers that were not previously observed in baseline traffic.

Monitoring Recommendations

Ingest IIS, ULS, and firewall egress logs into a central analytics platform such as Singularity Data Lake for correlation across the SharePoint tier.
Baseline outbound connections from SharePoint application pools and flag deviations to internal management interfaces.
Track authenticated API calls per user account and alert on sudden spikes in requests that carry URL-shaped parameters.

How to Mitigate CVE-2026-70326

Immediate Actions Required

Apply the security update referenced in the Microsoft CVE-2026-70326 Advisory to all SharePoint Server Subscription Edition farms.
Restrict SharePoint server egress traffic to only the destinations required for business operations, blocking access to internal management interfaces and cloud metadata endpoints.
Review SharePoint accounts with authenticated access and enforce least privilege, removing dormant or over-permissioned accounts.

Patch Information

Microsoft has released a security update via the Microsoft Security Response Center. Administrators should consult the Microsoft CVE-2026-70326 Advisory for the applicable KB article and cumulative update package for their SharePoint Server build. Apply updates through standard SharePoint patching procedures, including the SharePoint Products Configuration Wizard after binary installation.

Workarounds

Constrain SharePoint outbound network access at the host firewall or perimeter to a defined allowlist of destinations.
Require multi-factor authentication and conditional access on all SharePoint user accounts to reduce credentialed-attacker risk.
Segment SharePoint servers away from sensitive internal services and cloud instance metadata endpoints.
Enable enhanced logging on SharePoint web front-ends to support rapid investigation of suspected SSRF activity.

bash

# Example egress restriction using Windows Firewall to block SharePoint
# server from reaching cloud instance metadata and loopback pivots.
New-NetFirewallRule -DisplayName "Block SharePoint SSRF Metadata" `
  -Direction Outbound -Action Block `
  -RemoteAddress 169.254.169.254 `
  -Program "C:\Windows\System32\inetsrv\w3wp.exe"