CVE-2026-64921

Think of SharePoint like the office building where documents are stored. This vulnerability is like a door guard problem that can let someone move from “allowed visitor” to “trusted staff” by gaining higher permissions. Once that happens, they may be able to view or manage more than they should—and they can potentially disrupt normal operations.

This matters if you run Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition (including “sharepoint server” deployments). The weakness is specifically about elevating privileges, so it targets organizations that rely on SharePoint for sensitive documents and business workflows.

This is primarily a risk when an attacker can reach the SharePoint environment and can get an authorized position (for example, credentials or access inside the environment are the likely starting point).

This is RED because it’s a high-impact privilege-escalation issue in widely used SharePoint Server software, and Microsoft has already released fixed versions. Recent security attention also points to interest from the Lazarus group, increasing the practical risk.

Even though there’s no public exploit code on record and it’s not listed in CISA KEV, you should treat this as a serious patch-now item for any affected SharePoint deployment.