CVE-2026-69716

CVE-2026-69716 is a SQL injection flaw (CWE-89) in Microsoft Office SharePoint in which special elements are not properly neutralized before being used in an SQL command. A remote attacker who already holds authorized (low-privilege) credentials sends crafted input over the network that reaches the database layer, allowing the injection to execute. Successful exploitation elevates the attacker's privileges on the affected SharePoint Server deployment, with the CVSS vector indicating high impact on confidentiality, integrity, and availability. The affected product per the CVE data is on-premises Microsoft SharePoint Server; organizations running it should treat authenticated users as potential exploit sources. As of this writing there is no known exploitation in the wild, no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates a 0.9% chance of exploitation within 30 days.

What to do: Track Microsoft's advisory and apply the SharePoint Server security update as soon as it is released through Microsoft's regular update channels; do not delay patching on internet-facing farms. Because exploitation requires only an authorized low-privilege account, enforce MFA, review and remove unused SharePoint accounts, and restrict network exposure of SharePoint front-end servers. Monitor for anomalous database queries or unexpected privilege changes in SharePoint logs until patches are fully deployed.