CVE-2026-102866: Microsoft Office SharePoint Elevation of Privilege Vulnerability

For IT administrators managing on-premises collaboration infrastructure, this advisory requires direct patch deployment. Specifically, the vulnerability affects Microsoft SharePoint Server Subscription Edition (x64), and Microsoft has issued KB5002927 to resolve the underlying cryptographic verification weakness and bring installations up to fixed build 16.0.20326.20190.

Vulnerability Overview and Risk Breakdown​

At its core, CVE-2026-102866 is classified under CWE-347 (Improper Verification of Cryptographic Signature). According to the official Microsoft Security Response Center (MSRC) description:

"Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network."

Click to expand...

Below is the complete breakdown of the metrics and status indicators confirmed in the official advisory:

• CVE ID: CVE-2026-102866
• Title: Microsoft Office SharePoint Elevation of Privilege Vulnerability
• Severity: Critical
• CVSS Base Score: 8.1
• CVSS Temporal Score: 7.1
• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
• Weakness Classification: CWE-347
• Exploitation Assessment: Exploitation Less Likely
• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

How the Attack Works: Token Tampering Without User Interaction​

When evaluating a Critical SharePoint vulnerability, system administrators need to know exactly what an attacker has to do to trigger the flaw and what level of access is gained. Microsoft's official advisory facts provide clear answers on the mechanics of CVE-2026-102866:

• Token Modification and Impersonation: How could an attacker exploit this vulnerability? An unauthenticated attacker who obtains a valid proof token for a targeted user could modify the token and submit it to an affected SharePoint server. Successful exploitation could allow the attacker to authenticate as that user and access or modify content available to the compromised account. User interaction is not required.
• High Attack Complexity (AC:H): According to the CVSS metric, the attack complexity is high (AC:H). What does this mean for this vulnerability? An attacker would need specific conditions to be in place (i.e. particular protocol settings, or configurations, etc.) before an attack could succeed, which reduces the likelihood of widespread or opportunistic exploitation.
• Preview Pane Exclusion: Is the Preview Pane an attack vector for this vulnerability? No, the Preview Pane is not an attack vector.

From an architectural perspective, the combination of AV:N (Network attack vector), PR:N (No privileges required), and UI:N (No user interaction required) explains why Microsoft assigned a Critical severity rating despite the 8.1 CVSS base score. Because a compromised proof token can be altered and submitted directly over the network without needing a user to click a link or open a file, the Confidentiality (C:H), Integrity (I:H), and Availability (A:H) impacts are all rated High within the security scope (S:U).

At the same time, the requirement that an attacker first obtain a valid proof token for a targeted user—combined with specific protocol settings or server configurations required by the high attack complexity (AC:H)—aligns with Microsoft's assessment of Exploitation Less Likely.

Section Summary: CVE-2026-102866 allows an unauthenticated attacker who obtains a valid proof token for a targeted user to modify that token and authenticate as the victim on an affected SharePoint server without user interaction, though specific server or protocol conditions must be present for the attack to succeed.

Affected Products and Remediation Guide​

To protect enterprise SharePoint farms against proof-token manipulation, administrators must apply the official security update provided by Microsoft.

Actionable Guidance for SharePoint Administrators​

1. Verify Current Build Numbers: Check your existing Microsoft SharePoint Server Subscription Edition (x64) farm servers to determine whether they are running a build earlier than 16.0.20326.20190.
2. Deploy KB5002927: Schedule and install KB5002927 across all affected servers in your SharePoint farm. For Microsoft SharePoint Server Subscription Edition (x64), install KB5002927 to reach fixed build 16.0.20326.20190.
3. Confirm Post-Patch State: After applying the binary update and completing any required SharePoint configuration tasks for your environment, confirm that the farm reports fixed build 16.0.20326.20190.

Section Summary: Customer action is required. Administrators running Microsoft SharePoint Server Subscription Edition (x64) should install KB5002927 to update their installations to fixed build 16.0.20326.20190 and close CVE-2026-102866.