CVE-2026-70266

Summary

This CVE describes a SQL injection vulnerability in Microsoft SharePoint Server that allows authenticated attackers to execute arbitrary SQL commands and elevate their privileges. The flaw occurs when user input is not properly sanitized before being included in SQL queries, potentially enabling attackers to manipulate database operations.

Exploitability

Exploitation requires an authenticated user account with access to SharePoint functionality, making it moderately difficult but achievable through social engineering or credential compromise, with no additional preconditions beyond standard authentication.

Blast radius

If exploited, this vulnerability could allow attackers to gain full administrative control over SharePoint databases, potentially leading to data exfiltration, privilege escalation across the organization, and unauthorized access to sensitive business information.

Detection

Monitor for unusual database query patterns in SharePoint logs, particularly those involving dynamic SQL construction with user-supplied input, and watch for failed authentication attempts followed by successful database access patterns.

Prioritized remediation

Apply the Microsoft security update KB5042890 or later to fix this SQL injection vulnerability in SharePoint Server.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.