CVE-2026-69465

CVE-2026-69465 is a missing authorization flaw (CWE-862) in Microsoft Office SharePoint, specifically SharePoint Server. An attacker who already holds valid, low-privileged credentials can send a crafted network request to the server, and because the application fails to properly verify permissions, the request results in arbitrary code execution. Successful exploitation gives the attacker code execution on the server with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8 High), with no user interaction required. Organizations running on-premises SharePoint Server are affected; the specific version ranges are not stated in the available data. There is currently no known in-the-wild exploitation, no public proof-of-concept, and the flaw is not listed in CISA KEV, with EPSS estimating a 0.8% chance of exploitation within 30 days.

What to do: Apply the SharePoint Server security update that addresses this CVE as published in Microsoft's Patch Tuesday release (consult the Microsoft Security Update Guide for the exact KB and affected versions). Until patched, reduce exposure by limiting which accounts can reach SharePoint externally (VPN/extranet access) and monitoring authenticated requests for anomalous activity. Since exploitation requires an authorized account, review whether low-privileged or external users have access to internet-facing SharePoint servers.