Server-Side Request Forgery in Microsoft Office SharePoint by Microsoft
CVE-2026-88206

7.5HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft Sharepoint Server Subscription Edition
Vendor
CVE Published:
13 October 2026

What is CVE-2026-88206?

This vulnerability in Microsoft Office SharePoint allows an authorized attacker to perform server-side request forgery (SSRF), leading to potential privilege elevation within the network. Such exploitation could result in unauthorized access to sensitive resources and data, requiring immediate attention to secure impacted environments. Microsoft has provided advisory and patches to remediate this issue, highlighting the importance of keeping software up to date to mitigate potential risks.

Affected Version(s)

Microsoft SharePoint Server Subscription Edition x64-based Systems 16.0.0 < 16.0.20326.20190

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.