What happened
A high-severity vulnerability has been identified in Microsoft SharePoint Server Subscription Edition, CVE-2026-108452. The flaw involves an improper limitation of a pathname to a restricted directory, known as a path traversal vulnerability. This weakness permits an unauthenticated or low-privileged attacker to execute code remotely over a network by exploiting an exposed service. The vulnerability specifically affects versions of Microsoft SharePoint Server Subscription Edition (x64-based systems) ranging from version 16.0.0 up to, but not including, 16.0.20326.20190. Successful exploitation could lead to a full compromise of the affected server, given the high impact and severity scores assigned. Who is affected Organisations operating affected versions of Microsoft SharePoint Server Subscription Edition are at risk, particularly where services are exposed directly over a network without adequate protection. Any deployment that does not employ sufficient segmentation, network controls, or access restrictions may be vulnerable to exploitation. As the vulnerability can be exploited with existing low-level privileges and requires no user interaction, the threat could be immediate and severe in exposed environments. Recommended actions
Review network exposure of SharePoint services; restrict access to trusted networks and segment the environment to limit direct access. Implement strong access controls and authentication mechanisms to reduce the likelihood of unauthorised exploitation. Apply any available patches or updates once they are released by the vendor, as the current status indicates no patch is available at this time. Monitor network traffic and logs for unusual activity indicative of an exploitation attempt. Ensure that security best practices for network security and perimeter defence are followed to mitigate the risk of exploit through exposed services.
