CVE-2026-64901

Think of SharePoint like a building with secure doors, where only certain staff can enter. This bug lets an attacker who has low-level access to the building “trick” SharePoint into handling malicious input in a way that can make the server run their code—without needing anyone to click or do anything. If it’s reachable from the attacker’s side, it can lead to the whole server being controlled, including access to files and services.

This matters if your organization runs Microsoft SharePoint Server, including Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition. The risk is highest when an attacker can gain low-level permissions (since low privileges are enough) and the vulnerable functionality can be reached over the network. There’s no requirement for a user to click a link for this issue.

This should be treated as RED priority because the vulnerability enables remote code execution with full impact on the server (confidentiality, integrity, and availability). Even though public exploit code and confirmed incidents are not shown in the findings, the flaw design requires only low-level authorization and no user interaction—making it attractive to attackers once they have access.