CVE-2026-47298: Microsoft SharePoint Server Remote Code Execution Vulnerability

Synopsis

An improper authorization vulnerability in Microsoft SharePoint Server allows a network-accessible attacker with a low-privilege account to execute arbitrary code on the server. Exploitation requires the attacker to hold valid SharePoint credentials and to get a victim user to perform an action (such as clicking a crafted link), but no admin rights are needed. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected SharePoint instance. Patched-image rebuilds at versions 16.0.5556.1005, 16.0.10417.20153, and 16.0.19725.20384 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SharePoint service over the network; the service must be exposed to the attacker's network path.

• AuthenticationRequired

  A low-privilege SharePoint account is sufficient; no administrative or elevated credentials are needed.

• Victim interactionRequired

  A legitimate SharePoint user must perform an action (such as clicking a crafted link or opening a malicious document) for the exploit to succeed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific memory layout.

Blast Radius

• Reads any content stored in SharePoint, including documents, lists, and stored credentials or tokens accessible to the server process.
• Modifies or deletes SharePoint content, site configurations, and persisted database rows.
• Crashes or degrades the SharePoint service, denying access to all users of the affected instance.
• Enables lateral movement if the compromised server process has access to adjacent internal services or identity stores.