CVE-2026-62837

This vulnerability is like a trick that lets someone who already has an account on your SharePoint “reach for” files they should not be able to view, and then read confidential information over the network. No one needs to click anything or do anything special for the leak to happen. The risk is mainly about unauthorized account access or misuse of existing access.

This matters if you run Microsoft SharePoint Server and someone can log into it with an authorized account (for example, a compromised employee account or an internal user with the wrong permissions). The flaw is reachable over the network and does not require any user action to trigger. The practical risk is highest when an attacker already has valid access to your SharePoint system.

This is urgent because the weakness allows an attacker with authorized access to remotely steal sensitive information from SharePoint, and the traffic-light verdict for this CVE is RED. While no clear dated “in-the-wild” reporting was provided here, the patch is associated with a new security development and a known threat actor in the provided reporting, so you should not delay upgrading.

1. Confirm exposure (edition + build)

• Identify which product you run: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition.
• Record your current SharePoint Server build/version.

2. Determine whether you’re affected

• Use Microsoft’s guidance for CVE-2026-62837 at: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62837
• In general, treat your server as affected if its build is earlier than the fixed versions listed by Microsoft for your edition.

3. Upgrade to the fixed version (required)

• SharePoint Server -> fixed in 16.0.19725.20522
• SharePoint Server Subscription Edition -> fixed in 16.0.19725.20522
• Microsoft SharePoint Enterprise Server 2016 -> fixed in 16.0.5565.1001
• Microsoft SharePoint Server 2019 -> fixed in 16.0.10417.20198

4. Patch rollout notes

• Plan the upgrade during a maintenance window as SharePoint updates can require service restarts.
• Validate after the upgrade that the running build/version matches the fixed version for your edition.

5. Temporary workarounds if patching is delayed

• Reduce the chance of an attacker getting “authorized access”: review user accounts, disable or remove unused accounts, and enforce strong authentication for SharePoint logins.
• Tighten access controls so that accounts have the minimum permissions needed (least privilege), especially for areas containing sensitive documents.

6. What to monitor after remediation

• Look for unusual authenticated access patterns (logins from unexpected locations, repeated access to sensitive content, or abnormal browsing of document repositories).
• Review SharePoint audit logs for access to restricted or high-value locations that don’t match normal user behavior.

Severity and type: This is an information disclosure issue (CWE-23) in Microsoft SharePoint Server. Findings indicate a file path manipulation flaw (path traversal) that allows an authenticated user to steal sensitive information via network communication without user interaction.

Attack prerequisites and reachability: The attacker must have authorized access to the SharePoint system (findings state low authentication requirements and “no user interaction”). The findings do not confirm whether exploitation is reachable in default configurations, so exposure should be assessed based on whether an attacker could realistically gain an account on your SharePoint environment.

Exploitation status: KEV is not listed, and the provided news reporting does not cite clear dated real-world exploitation for this CVE. However, provided reporting associates this patch with the Lazarus group, and the verdict is RED, so remediation should be treated as high priority.

Patch availability: Fixed builds are available per Microsoft for each affected edition (listed in the what_to_do section).