Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-64921: Unauthorized Access to Microsoft SharePoint Server

CVE-2026-64921 · published 2 months ago

Summary

An attacker with authorized access to Microsoft SharePoint Server can gain higher-level access to sensitive data and functions. This is a serious concern as it allows an attacker to manipulate or steal sensitive information. To protect your server, ensure you have the latest updates and security patches installed, and consider implementing additional security measures to limit user access.

What to do

Update microsoft microsoft sharepoint enterprise server 2016 to version 16.0.5565.1001 or later.
Update microsoft microsoft sharepoint server 2019 to version 16.0.10417.20198 or later.
Update microsoft microsoft sharepoint server subscription edition to version 16.0.19725.20522 or later.
Update microsoft sharepoint_server to version 16.0.19725.20522 or later.

Affected software

Vendor	Product	Affected versions
microsoft	microsoft sharepoint enterprise server 2016	< 16.0.5565.1001
microsoft	microsoft sharepoint server 2019	< 16.0.10417.20198
microsoft	microsoft sharepoint server subscription edition	< 16.0.19725.20522
microsoft	sharepoint_server	< 16.0.19725.20522 2016 2019 `cpe:2.3:a:microsoft:sharepoint_server:::::subscription:::*`

Original advisory text

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Missing authentication for critical function in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64921 vendor-advisory patch

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-306Missing Authentication for Critical Function

Timeline

Published11 Aug 2026

Updated3 Nov 2026

First seen11 Aug 2026

Sources

CVE-2026-64921 · NVD

CVE-2026-64921 · MITRE

Track software like this

Free during beta