CVE-2026-62827

This vulnerability is like a locked door that still lets someone with a key raise their access level. If an attacker already has some legitimate access to your SharePoint environment, they may be able to turn that into higher privileges, which can lead to more access than they should have.

This matters if you run Microsoft SharePoint Server (including SharePoint Server Enterprise 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition). Because the flaw is described as involving “authorized” attackers, the bigger risk is when an attacker can already reach or access your SharePoint environment (for example, valid credentials or an already-compromised account). This is a network-access issue, so it matters most when your SharePoint is reachable from untrusted networks or when attackers can authenticate to it.

Mark this as RED because Microsoft has provided fixes and there is new security attention around the patch, including activity attributed to the Lazarus group. Even without confirmed public exploit code, elevation-of-privilege flaws are high-impact in SharePoint because they can expand what an attacker can do once they have a foothold. Act quickly to move to the fixed SharePoint build for your edition.