CVE-2026-62839

Think of SharePoint like a receptionist that verifies who you are before giving access. This flaw lets an attacker (if they already have some access) present the system as if they are a different, trusted person—like showing a fake badge. That can lead to impersonation and unauthorized access to what the impersonated user could reach.

This matters if you run Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition, or sharepoint server.

It’s most relevant when an attacker already has some authorization/access to the SharePoint system (the findings indicate low prerequisites and no user interaction). It is also network-reachable in the Microsoft Office SharePoint setup, so systems exposed to the internet or internal users should be treated as higher concern.

This is RED because an identity-spoofing weakness can enable impersonation once an attacker has gained some access, and the vulnerability is being addressed via a recent Microsoft patch release. Even without confirmed public exploit code or a KEV listing, the combination of network reachability and account impersonation risk makes it urgent to fix.