CVE-2026-62827 – Microsoft SharePoint Server Elevation of Privilege Vulnerability

CVE-2026-62827 is a Critical elevation-of-privilege vulnerability caused by improper authentication in Microsoft SharePoint Server. An authenticated attacker with domain access and low privileges could exploit the vulnerability over the network to elevate themselves to SharePoint administrator. The vulnerability can have a high impact on confidentiality, integrity, and availability.

CVSS Score: 8.8.

SEVERITY: Critical.

THREAT:
An attacker who already has authenticated domain access could target a vulnerable SharePoint server remotely. Successful exploitation could elevate the attacker to SharePoint administrator, significantly expanding their control over the environment. Attack complexity is low, and no user interaction is required.

EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as unproven, and exploitation is assessed as less likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept code is identified.

TECHNICAL SUMMARY:
The vulnerability is caused by improper authentication (CWE-287) in Microsoft Office SharePoint. An authenticated attacker with low privileges and access to the domain can exploit the issue over the network. The described attack could enable remote code execution on the SharePoint server as part of elevating the attacker to SharePoint administrator. The CVSS metrics identify network-based access, low attack complexity, low privileges required, no user interaction, and high potential impact to confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products are Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition. Exploitation requires an authenticated attacker with domain access and low privileges; no user interaction is required.

BUSINESS IMPACT:
Successful exploitation could give an attacker SharePoint administrator privileges, creating serious risk to information stored and managed through SharePoint. With confidentiality, integrity, and availability all rated High for impact, exploitation could expose sensitive information, enable unauthorized changes, and disrupt SharePoint services.

WORKAROUND:
No workaround or mitigation is identified. An official fix is available, and all applicable security updates for the installed SharePoint software should be applied.

URGENCY:
This vulnerability carries a Critical severity rating and a CVSS base score of 8.8. Although it is not known to be exploited or publicly disclosed, its network attack vector, low attack complexity, and potential for SharePoint administrator privilege elevation make timely deployment important.