Server-Side Request Forgery in Microsoft Office SharePoint
CVE-2026-70259

6.5MEDIUM

Key Information:

Vendor

Microsoft
Status
Microsoft Sharepoint Server Subscription Edition
Vendor
CVE Published:
13 October 2026

What is CVE-2026-70259?

A Server-side Request Forgery vulnerability in Microsoft Office SharePoint allows an attacker with authorized access to send crafted requests. This can lead to unauthorized disclosure of sensitive information across the network, posing significant risks to data integrity and confidentiality. Implementing the latest updates is crucial to mitigate this security issue.

Affected Version(s)

Microsoft SharePoint Server Subscription Edition x64-based Systems 16.0.0 < 16.0.20326.20190

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.