{"id":"CVE-2026-102863","published":"2026-10-13T19:17:50.837","lastModified":"2026-10-14T19:45:34.913","description":"Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":["microsoft"],"products":["sharepoint server"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102863","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows authenticated attackers to inject malicious code into SharePoint Server, potentially leading to privilege escalation and full system compromise. The flaw exists in how SharePoint handles code generation, making it susceptible to code injection attacks.","exploitability":"Exploitation requires an authenticated user account with access to SharePoint Server, making it moderately difficult to achieve but not highly complex, as the attacker can leverage their existing credentials to inject and execute malicious code.","blast_radius":"If exploited, this vulnerability could allow attackers to gain full administrative control over SharePoint Server instances, potentially affecting thousands of users and sensitive organizational data across multiple SharePoint sites.","remediation":"Apply the Microsoft security update KB5042891 or later to all SharePoint Server 2019 and SharePoint Server 2021 installations immediately.","detection":"Monitor for unusual file creation patterns in SharePoint's temporary directories, particularly .aspx files with embedded malicious code, and watch for elevated privilege usage in SharePoint service accounts.","tags":["code-injection","sharepoint","privilege-escalation","web"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:53:07.635Z"}}