CVE-2026-102865: Microsoft Office SharePoint Information Disclosure Vulnerability

While this issue does not grant unauthenticated remote code execution, it undermines a core pillar of enterprise data governance: confidentiality. Below is a complete technical breakdown of the vulnerability, its risk profile, and the exact remediation steps required for affected environments.

Vulnerability Overview and Official Summary​

At its core, CVE-2026-102865 is rooted in how SharePoint validates user permissions when handling network requests. As documented in the official MSRC description:

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

Click to expand...

Microsoft classifies this issue under the weakness category CWE-863 (Incorrect Authorization). Unlike authentication flaws—which allow an outsider to bypass the login screen entirely—an authorization flaw under CWE-863 means the system knows who the user is, has already let them through the front door with valid credentials, and then fails to properly verify whether that specific user has the right to read a requested resource.

Key Advisory Metrics and Status Indicators​

To help enterprise administrators prioritize their patch management queues, Microsoft has published the following official scoring and status details for CVE-2026-102865:

• Title: Microsoft Office SharePoint Information Disclosure Vulnerability
• CVE ID: CVE-2026-102865
• Severity: Important
• CVSS Base Score: 6.5
• CVSS Temporal Score: 5.7
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
• Weakness (CWE): CWE-863
• Exploitation Assessment: Exploitation Less Likely
• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

Decoding the CVSS Vector and Real-World Impact​

Why does an Important-rated vulnerability with a base score of 6.5 warrant prompt scheduling during your maintenance window? Looking closely at the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) tells the real story for IT security teams:

1. Attack Vector — Network (AV:N) and Attack Complexity — Low (AC:L): The flaw is exploitable over the network without requiring convoluted race conditions or specialized environmental prerequisites.
2. Privileges Required — Low (PR:L) and User Interaction — None (UI:N): An attacker does not need farm administrator rights, nor do they need to trick a victim into clicking a link. Any standard authenticated user account with basic access to the SharePoint server is sufficient to attempt the request.
3. Confidentiality Impact — High (C:H), Integrity — None (I:N), Availability — None (A:N): While the attacker cannot modify files or crash the service through this vector, the confidentiality barrier is significantly compromised.
4. Temporal Metrics (E:U/RL:O/RC:C): The temporal score drops to 5.7 because exploit code maturity is unproven (E:U), an official fix is available (RL:O), and report confidence is confirmed (RC:C).

Official Advisory Facts: What IsActually Exposed?​

When dealing with SharePoint vulnerabilities, administrators typically ask two immediate operational questions: What data can be stolen, and can this be triggered passively just by viewing a file in a preview window? The MSRC advisory addresses three specific points directly:

• Vulnerability Definition: Microsoft Office SharePoint Information Disclosure Vulnerability: Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
• Exposed Data Type: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is file content.
• Preview Pane Vector: Is the Preview Pane an attack vector for this vulnerability? No, the Preview Pane is not an attack vector.

In practical terms, the exposure of file content is the critical takeaway for compliance and security officers. Sometimes information disclosure bugs only leak server paths, metadata headers, or internal IP addresses. Here, the advisory explicitly confirms that actual document and file contents stored within the repository are at risk of unauthorized disclosure to low-privileged users. In an enterprise setting where human resources records, financial spreadsheets, or legal contracts reside on the same SharePoint farm as general staff portals, an authorization bypass that exposes file content represents a direct insider-threat multiplier.

Affected Products and Remediation Guidance​

Because Customer action required: Yes is set for this advisory, administrators running the affected edition must apply the corresponding Microsoft security update to close the authorization gap.

Exact Remediation Instruction​

To resolve CVE-2026-102865, follow Microsoft's official remediation requirement:

• For Microsoft SharePoint Server Subscription Edition (x64), install KB5002927 to reach fixed build 16.0.20326.20190.

Operational Checklist for SharePoint Administrators​

Based on general industry knowledge for maintaining SharePoint Server environments, administrators should keep a few operational best practices in mind when deploying KB5002927:

• Verify Build Numbers Post-Installation: Installing the binary package is only the first step in a SharePoint farm update. Ensure that your farm configuration database and servers properly reflect the target fixed build of 16.0.20326.20190 after running the SharePoint Products Configuration Wizard (PSConfig.exe or the PowerShell equivalent).
• Audit Internal Access Logs: Even though the vulnerability is marked as Publicly disclosed: No, Exploited: No, and carries an assessment of Exploitation Less Likely, maintaining clear visibility into unusual file access patterns from authenticated accounts remains sound defense-in-depth practice prior to patch deployment.

Section Summary​

CVE-2026-102865 (Microsoft Office SharePoint Information Disclosure Vulnerability) is an Important severity flaw (CVSS Base: 6.5, CVSS Temporal: 5.7) caused by CWE-863 (Incorrect Authorization). It enables an authenticated attacker with low privileges to disclose file content over a network without user interaction, though the Preview Pane is not an attack vector. Organizations running Microsoft SharePoint Server Subscription Edition (x64) must install KB5002927 to update their installations to fixed build 16.0.20326.20190.