{"id":"CVE-2026-102861","published":"2026-10-13T19:17:50.590","lastModified":"2026-10-14T19:45:29.283","description":"Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":["microsoft"],"products":["sharepoint server"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102861","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Microsoft SharePoint Server has a missing authorization check that allows authenticated users to elevate their privileges and perform actions they shouldn't be able to, potentially leading to full system compromise. This vulnerability exists in the network-based access controls for SharePoint operations.","exploitability":"Exploitation requires an authenticated user account with existing SharePoint access, making it moderately difficult but not highly complex to achieve privilege escalation across a network.","blast_radius":"If exploited, this flaw could allow attackers to gain administrative control over SharePoint content and potentially move laterally to other systems through shared credentials or access patterns.","remediation":"Apply the Microsoft security update KB5047891 for SharePoint Server 2019 and SharePoint Server 2021, or upgrade to SharePoint Server 2026 or later versions.","detection":"Monitor for unusual privilege elevation events in SharePoint audit logs, particularly when users access administrative functions without proper authorization. Look for failed authentication attempts followed by successful elevated access patterns in the SharePoint trace logs.","tags":["authorization","privilege-escalation","sharepoint","network"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:52:53.295Z"}}