CVE-2026-102860: Microsoft Office SharePoint Elevation of Privilege Vulnerability

Vulnerability Overview and Risk Profile​

At the core of CVE-2026-102860 is CWE-284 (Improper Access Control). According to Microsoft's official advisory description: "Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network."

While the vulnerability carries an Important severity rating rather than Critical, its CVSS v3.1 metrics highlight why administrators should not push this patch to the back burner. It holds a CVSS base score of 8.8 and a CVSS temporal score of 7.7, represented by the exact vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C.

Here is the complete breakdown of the Microsoft Security Response Center (MSRC) status indicators and scoring metrics for CVE-2026-102860:

• CVE ID: CVE-2026-102860
• Title: Microsoft Office SharePoint Elevation of Privilege Vulnerability
• Severity: Important
• CVSS Base Score: 8.8
• CVSS Temporal Score: 7.7
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
• Weakness Classification: CWE-284
• Exploitation Assessment: Exploitation Less Likely
• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

Section Summary: CVE-2026-102860 is an Important-rated access control flaw (CWE-284) with an 8.8 base score that allows an authenticated user to escalate privileges over a network without requiring any user interaction.

Technical Details and Official Advisory Facts​

Why does an elevation of privilege vulnerability carry high impact scores across confidentiality (C:H), integrity (I:H), and availability (A:H)? The answer lies in what a successful permission jump unlocks inside a SharePoint environment.

In its official advisory guidance, Microsoft clarifies the exact mechanics and boundaries of the flaw through two specific questions and answers:

• What privileges could an attacker gain with a successful exploitation? Due to default configurations, an unprivileged user could get Site Owner Permissions, allowing the attacker to use this vulnerability to inject arbitrary code into the server.
• Is the Preview Pane an attack vector for this vulnerability? No, the Preview Pane is not an attack vector.

From an administrative perspective, the leap from an unprivileged, authenticated account (PR:L) to Site Owner Permissions under default configurations is a significant boundary failure. Because gaining Site Owner Permissions allows the attacker to use this vulnerability to inject arbitrary code into the server, a standard domain user or compromised low-tier account could effectively turn an access control weakness into server-side code execution. Furthermore, the attack complexity is low (AC:L) and requires no interaction from another user (UI:N).

Thankfully, the current threat landscape gives defenders a window to act: the flaw is marked with an assessment of Exploitation Less Likely, with Publicly disclosed: No and Exploited: No.

Section Summary: Under default configurations, exploiting CVE-2026-102860 lets an unprivileged user acquire Site Owner Permissions and inject arbitrary code into the server, though the Preview Pane is not an attack vector.

Affected Products and Remediation Guidance​

Because Customer action required: Yes applies to this release, organizations running the affected platform must deploy the designated update to close the access control gap.

To remediate this vulnerability:

1. Identify all servers in your environment running Microsoft SharePoint Server Subscription Edition (x64).
2. Obtain and apply update KB5002927 across your SharePoint farm nodes during your next maintenance window.
3. Verify that the installation succeeds and that the product version advances to fixed build 16.0.20326.20190.

Section Summary: Administrators must fulfill the required customer action by installing KB5002927 on Microsoft SharePoint Server Subscription Edition (x64) to bring servers to fixed build 16.0.20326.20190.