CVE-2026-102861

Summary

Microsoft SharePoint Server has a missing authorization check that allows authenticated users to elevate their privileges and perform actions they shouldn't be able to, potentially leading to full system compromise. This vulnerability exists in the network-based access controls for SharePoint operations.

Exploitability

Exploitation requires an authenticated user account with existing SharePoint access, making it moderately difficult but not highly complex to achieve privilege escalation across a network.

Blast radius

If exploited, this flaw could allow attackers to gain administrative control over SharePoint content and potentially move laterally to other systems through shared credentials or access patterns.

Detection

Monitor for unusual privilege elevation events in SharePoint audit logs, particularly when users access administrative functions without proper authorization. Look for failed authentication attempts followed by successful elevated access patterns in the SharePoint trace logs.

Prioritized remediation

Apply the Microsoft security update KB5047891 for SharePoint Server 2019 and SharePoint Server 2021, or upgrade to SharePoint Server 2026 or later versions.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.