Microsoft’s advisory identifies the flaw as Microsoft Office SharePoint Remote Code Execution Vulnerability. It stems from improper access control, tracked as CWE-284, in Microsoft Office SharePoint. Microsoft describes the issue succinctly: “Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.”
The CVSS base score is 8.8, with a temporal score of 7.7. Microsoft’s supplied CVSS vector is:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
The score reflects a network-reachable attack that has low complexity but requires privileges. In practical SharePoint terms, the privilege requirement should not be mistaken for an administrative boundary: Microsoft says an authenticated attacker with low-level, list-level permissions could exploit it.
CVE-2026-69282 lets a list-level SharePoint user target server code execution
Microsoft’s advisory explains that the attacker could submit a specially crafted event receiver definition. This could cause SharePoint to load an attacker-specified code library and construct an attacker-specified type before the server verifies whether the caller is authorized to do so.
If that sequence succeeds, the attacker can execute code on the SharePoint server. The immediate concern is therefore the server hosting the SharePoint workload, not merely the site or list where the malicious definition originated. The advisory’s CVSS impacts are high for confidentiality, integrity, and availability, consistent with the potential consequences of server-side code execution.
The attack requires both network access and authentication. User interaction is not required. That makes ordinary phishing-style engagement unnecessary once an attacker has acquired or been granted suitable SharePoint credentials and can reach the service.
Microsoft rates the vulnerability Important.
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
Microsoft’s exploitation assessment is Exploitation Less Likely. That assessment is useful for prioritization, but it does not change the required remediation for the affected Subscription Edition product.
KB5002908 is the fixed update for SharePoint Server Subscription Edition
For Microsoft SharePoint Server Subscription Edition (x64), Microsoft directs customers to install KB5002908. The corresponding fixed build is 16.0.20326.20090.
The vendor’s remediation instruction is explicit: “For Microsoft SharePoint Server Subscription Edition (x64), install KB5002908 to reach fixed build 16.0.20326.20090.”
This is a server patching decision, not a client update. Organizations should identify SharePoint Server Subscription Edition (x64) installations in their environment, schedule the applicable maintenance activity under their established operational controls, and confirm that the system reaches the supplied fixed build after KB5002908 is installed.
Microsoft also advises that when multiple update packages are offered for software installed on a system, customers should apply all applicable updates. The packages may be installed in any order.
SharePoint Server 2016 and SharePoint Enterprise Server 2016 use the same KB number
Microsoft’s advisory also addresses a product-name point that can complicate patch inventory: updates for SharePoint Enterprise Server 2016 also apply to SharePoint Server 2016. Microsoft states that the same KB number applies to both versions and that customers running either version should install the security update to be protected from this vulnerability.
Administrators should preserve that distinction in their asset records. A deployment described internally as SharePoint Server 2016 should not be excluded simply because a security-update table or management process uses the SharePoint Enterprise Server 2016 name.
The supplied fixed-build mapping is specifically for Microsoft SharePoint Server Subscription Edition (x64): KB5002908 and build 16.0.20326.20090. The advisory’s statement about the common KB number for the two 2016 product names remains an important check for teams maintaining older SharePoint naming conventions.
What this means for you
Organizations operating Microsoft SharePoint Server Subscription Edition (x64) should prioritize KB5002908 and verify the server reaches build 16.0.20326.20090; teams responsible for SharePoint Server 2016 should also ensure the applicable security update is deployed under Microsoft’s shared-KB guidance.
- CVE-2026-69282 is an Important SharePoint remote code execution vulnerability with a CVSS base score of 8.8.
- The weakness is improper access control, classified as CWE-284.
- Exploitation requires network access and authenticated low-level, list-level permissions, but no user interaction.
- A successful attacker could cause SharePoint to load an attacker-specified code library and execute code on the SharePoint server.
- Microsoft SharePoint Server Subscription Edition (x64) is remediated by KB5002908, which reaches fixed build 16.0.20326.20090.
- Where multiple security updates apply to installed software, Microsoft says to apply all of them; their installation order does not matter.
CVE-2026-69282 is a clear reminder that low-level SharePoint permissions can still become a server-security issue when authorization checks occur too late in a processing path. Microsoft has supplied the update path for SharePoint Server Subscription Edition (x64), and the operational task is now to apply KB5002908, validate build 16.0.20326.20090, and ensure relevant SharePoint Server 2016 deployments receive their applicable security update.