{"id":"CVE-2026-70266","published":"2026-10-13T19:19:45.300","lastModified":"2026-10-14T19:44:57.780","description":"Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":["microsoft"],"products":["sharepoint server"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70266","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This CVE describes a SQL injection vulnerability in Microsoft SharePoint Server that allows authenticated attackers to execute arbitrary SQL commands and elevate their privileges. The flaw occurs when user input is not properly sanitized before being included in SQL queries, potentially enabling attackers to manipulate database operations.","exploitability":"Exploitation requires an authenticated user account with access to SharePoint functionality, making it moderately difficult but achievable through social engineering or credential compromise, with no additional preconditions beyond standard authentication.","blast_radius":"If exploited, this vulnerability could allow attackers to gain full administrative control over SharePoint databases, potentially leading to data exfiltration, privilege escalation across the organization, and unauthorized access to sensitive business information.","remediation":"Apply the Microsoft security update KB5042890 or later to fix this SQL injection vulnerability in SharePoint Server.","detection":"Monitor for unusual database query patterns in SharePoint logs, particularly those involving dynamic SQL construction with user-supplied input, and watch for failed authentication attempts followed by successful database access patterns.","tags":["sql-injection","sharepoint","privilege-escalation","database"],"model":"garnet-coder","analyzedAt":"2026-10-18T09:56:35.728Z"}}