Key points
- The flaw allows remote privilege escalation via improper cryptographic signature verification.
- It affects Microsoft SharePoint Server Subscription Edition versions prior to 16.0.20326.20190.
- No fix has been confirmed yet in the available source material.
Microsoft SharePoint Server contains a high-severity vulnerability that could allow attackers to gain elevated privileges. The issue stems from improper verification of cryptographic signatures and affects specific versions of the software.
What happened
The National Vulnerability Database records CVE-2026-102866 with a CVSS score of 8.1, classifying it as a high-severity threat. According to the official advisory from Microsoft Security Update Guide, the vulnerability involves improper verification of cryptographic signatures within Microsoft Office SharePoint. This flaw permits an unauthorised attacker to elevate privileges over a network connection.
The affected component is Microsoft SharePoint Server Subscription Edition. The vulnerability exists in all versions of this product before build 16.0.20326.20190. The underlying weakness is identified as CWE-347, which relates to improper verification of cryptographic signatures.
Why it matters
Organisations running unpatched versions of SharePoint Server face the risk of remote privilege escalation. An attacker exploiting this flaw can potentially gain higher-level access rights within the environment. This could compromise the integrity and confidentiality of data stored or managed by the server.
Security teams must verify their current versions against the affected build number. Systems running versions earlier than 16.0.20326.20190 are vulnerable. Failure to address this exposure leaves the organisation open to potential unauthorised control over the server.
What happens next
- Identify all instances of SharePoint Server Subscription Edition within the infrastructure.
- Check the current build version of each instance to see if it is earlier than 16.0.20326.20190.
- Monitor for official announcements regarding a security update from Microsoft.
- Prepare to apply the update once it becomes available to mitigate the risk.
Patch priority
Teams usually prioritise systems with direct internet exposure or those containing sensitive data. Check whether any SharePoint servers are accessible from untrusted networks before focusing on internal-only instances. Test any future update in a non-production environment first to ensure compatibility with existing workflows and customisations. Back up configuration files and databases before applying patches to allow for a quick rollback if issues arise. Coordinate with application owners to schedule maintenance windows that minimise disruption to business operations. Monitor logs for any unusual activity during the transition period.
What to do and how to stay safe: Microsoft
- Audit your inventory to locate any SharePoint Server instances running builds earlier than 16.0.20326.20190.
- Review network logs for suspicious authentication attempts or unexpected privilege changes on affected servers.
- Ensure your backup systems are current and tested before applying any patches to production environments.
- Once the vendor provides an update, apply it according to your organisation's change management procedures.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific versions of SharePoint Server are affected by CVE-2026-102866?
The vulnerability affects Microsoft SharePoint Server Subscription Edition versions prior to 16.0.20326.20190.
Is there a fix available for this vulnerability?
No fix has been confirmed yet in the available source material.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates CVE-2026-102866 as high severity with a CVSS score of 8.1.
