For administrators running Microsoft SharePoint Server Subscription Edition (x64), the remediation is specific: KB5002927, with fixed build 16.0.20326.20190. Microsoft assesses exploitation as Exploitation Less Likely, but customer action is required.
What the vulnerability allows
Microsoft describes the underlying issue as follows: “Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.” The assigned weakness is CWE-862, which identifies missing authorization.
The advisory describes an attack involving an authenticated user who already has permission to add or modify content on an affected SharePoint page. That attacker could store malicious script content in the page. When another user views and interacts with the affected content, the script could run in that user’s security context.
The resulting access is tied to the affected user’s permissions: successful exploitation could let the attacker perform actions permitted to that user, potentially accessing or modifying SharePoint data available to them. This is not a blanket statement that every successful attack grants unrestricted server administration.
The practical implication: content-editing permissions matter. An account permitted to contribute page content could become the starting point for an attack against another user with access to different or more sensitive information.
Severity, scores and exploitation status
Microsoft’s supplied vulnerability record lists:
| Field | Value |
|---|---|
| CVE | CVE-2026-88176 |
| Exact title | Microsoft Office SharePoint Elevation of Privilege Vulnerability |
| Severity | Important |
| CVSS base score | 8.8 |
| CVSS temporal score | 7.7 |
| Weakness | CWE-862 |
| Exploitation assessment | Exploitation Less Likely |
The complete CVSS vector is:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Microsoft also records these statuses:
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
The vector records network access, low attack complexity and low privileges, with high confidentiality, integrity and availability impacts. It also contains UI:N; separately, Microsoft’s exploitation narrative describes another user viewing and interacting with affected content. Both are part of the supplied advisory information.
“Exploitation Less Likely” is a prioritization assessment, not a substitute for applying the fix.
Affected product and fixed build
The supplied affected-product mapping is:
| Affected product | Security update | Vendor fixed version / fixed build |
|---|---|---|
| Microsoft SharePoint Server Subscription Edition (x64) | KB5002927 | 16.0.20326.20190 |
Microsoft’s remediation is explicit:
For Microsoft SharePoint Server Subscription Edition (x64), install KB5002927 to reach fixed build 16.0.20326.20190.
For operational tracking, administrators should record both the update identifier and the resulting build. A deployment marked complete should be checked against the fixed-build target, rather than treated as resolved solely because an update was scheduled.
Two advisory clarifications to keep separate
Microsoft explicitly states that the Preview Pane is not an attack vector for this vulnerability. Disabling it is therefore not a replacement for the security update.
Microsoft's advisory for this CVE lists only Microsoft SharePoint Server Subscription Edition as an affected product; it does not list SharePoint Server 2016. KB5002927 applies to the Subscription Edition only, so customers running SharePoint Server 2016 should follow the update guidance for their own version rather than installing this package.
What administrators should prioritize
The immediate action is to install the specified update and verify the fixed build for the mapped product.
As a practical risk-management measure derived from Microsoft’s attack description, administrators should also review who can add or modify SharePoint page content, particularly where those pages are used by people with broader data access. That review does not repair the authorization flaw, but it helps identify the attack’s required starting point.
The central risk is a breach of the permission boundary between a content contributor and another SharePoint user. Patching addresses the vulnerability; careful permission management helps limit the opportunities around it.
Correction (November 13, 2026): An earlier version of this article said the advisory also addressed SharePoint Server 2016 and SharePoint Enterprise Server 2016 with the same KB number. Microsoft's advisory for CVE-2026-88176 lists only SharePoint Server Subscription Edition as an affected product, and KB5002927 applies to the Subscription Edition only.