CVE-2026-58639

This vulnerability lets someone who already has an account in SharePoint use it like a “proxy” to reach places inside your private network that they normally shouldn’t be able to access. Even though it doesn’t fully take over SharePoint, it can let them impersonate other services or users by making the server fetch information from internal locations. Think of it like using the front desk phone to call departments you shouldn’t reach—while the call appears to come from inside the building.

This matters if your business runs Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition (sharepoint server). The key risk is that an attacker would need low-level authenticated access first (someone with basic credentials/permissions). It becomes relevant specifically when an attacker can log into SharePoint with those low privileges and then trigger the spoofing behavior through crafted requests.

This is RED because it targets Microsoft SharePoint Server and a low-privileged authenticated attacker can use it to cause spoofing by making the server fetch from hidden internal locations. Even though we don’t have clear dated public exploitation reporting or a KEV entry, the presence of a known patch and active threat interest (including actor-related reporting) means you should treat it as urgent to close the gap quickly.