{"id":"CVE-2026-70246","published":"2026-10-13T19:19:41.600","lastModified":"2026-10-14T19:44:52.410","description":"Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-863"],"vendors":["microsoft"],"products":["sharepoint server"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70246","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"SharePoint Server allows authenticated users to escalate their privileges through incorrect authorization checks, potentially enabling them to access restricted resources or perform administrative actions they shouldn't be able to. This vulnerability affects Microsoft's SharePoint platform and could lead to unauthorized data access or system compromise.","exploitability":"Exploitation requires an authenticated user account with existing access to SharePoint, making it moderately difficult to achieve initial access but relatively straightforward once the attacker has a valid login.","blast_radius":"If exploited, this vulnerability could allow attackers to gain administrative privileges across SharePoint sites, potentially leading to full system compromise, unauthorized data access, or privilege escalation to other users and systems within the SharePoint environment.","remediation":"Apply Microsoft Security Update MS26-078 for SharePoint Server 2019 and SharePoint Server 2021, or upgrade to SharePoint Server 2023 with the latest cumulative update.","detection":"Monitor for unusual privilege escalation attempts in SharePoint audit logs, particularly when users access administrative functions or elevated permissions without prior authorization. Look for failed authentication attempts followed by successful privilege elevation events in the SharePoint trace logs.","tags":["authorization","privilege-escalation","sharepoint"],"model":"garnet-coder","analyzedAt":"2026-10-18T09:55:58.010Z"}}