CVE-2026-64921 – Microsoft SharePoint Server Elevation of Privilege Vulnerability

CVE-2026-64921 is a critical elevation-of-privilege vulnerability in Microsoft SharePoint Server caused by missing authentication for a critical function. An authenticated attacker with domain access could exploit the issue over the network and execute code on the SharePoint server to elevate privileges to SharePoint administrator. Successful exploitation can result in high impact to confidentiality, integrity, and availability.

CVSS Score: 8.8.

SEVERITY: Critical.

THREAT:
The vulnerability has a network attack vector, low attack complexity, and requires low privileges with no user interaction. Successful exploitation could give an attacker SharePoint administrator privileges and lead to remote code execution on the SharePoint server.

EXPLOITS:
The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and no confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY:
The vulnerability results from missing authentication for a critical function in Microsoft Office SharePoint. An authenticated attacker with access to the domain can target the SharePoint server over the network and perform remote code execution to elevate themselves to SharePoint administrator. Exploitation has low attack complexity, requires low privileges, and does not require user interaction. A successful attack can have high confidentiality, integrity, and availability impact while leaving the security scope unchanged.

EXPLOITABILITY:
Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition are affected. An authenticated attacker with domain access can exploit the vulnerability remotely over the network. Low privileges are required, but no user interaction is needed.

BUSINESS IMPACT:
Successful exploitation could allow an attacker to gain SharePoint administrator privileges and execute code on the SharePoint server. For organizations relying on SharePoint for business information and collaboration, this creates the potential for unauthorized access to sensitive information, modification of content, and disruption of SharePoint services.

WORKAROUND:
No workaround or mitigation is identified. Apply all applicable security updates for the installed SharePoint software. Where multiple updates apply, all offered updates should be installed.

URGENCY:
This vulnerability is rated Critical and can be exploited over the network with low attack complexity and no user interaction once an attacker has authenticated domain access. Organizations should prioritize deployment of the applicable Microsoft security updates to prevent privilege escalation and potential remote code execution on affected SharePoint servers.