CVE-2026-70324

This vulnerability lets someone who already has a low-level account on SharePoint trick the server into reaching out to internal systems/services that it shouldn’t. By abusing that “server makes the request” behavior, the attacker can then take much higher control—up to full control of the SharePoint server. Think of it like giving a junior employee a phone extension; they can use it to place calls into restricted back-office lines and then act with much greater authority.

This matters to you if you use or host Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition. The risk is specifically for situations where an attacker already has an authenticated low-privilege account on SharePoint (no click or other user action is needed). Given it’s reachable in default configuration, you should assume it’s a real concern whenever such an account exists—especially if attackers might be able to log in (for example, via compromised credentials).

This is urgent because it lets an attacker with a low-privilege SharePoint account force the server to make internal requests and then gain full control. The traffic-light verdict is RED, and the only practical way to stop it is to install the fixed SharePoint updates for your version.

Confirm exposure

1. Identify the exact SharePoint product you run: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition (also referred to in the finding as “SharePoint Server”).
2. Check your current SharePoint build/version.
3. Compare against the fixed versions:
   • Enterprise Server 2016: fixed in 16.0.5565.1001
   • Server 2019: fixed in 16.0.10417.20198
   • Subscription Edition / SharePoint Server: fixed in 16.0.19725.20522

Patch/upgrade

1. Go to the Microsoft Update Guide for CVE-2026-70324 and install the update matching your SharePoint product.
2. Follow Microsoft’s normal patch procedure for SharePoint (apply the update in accordance with your maintenance window and any prerequisites).
3. Re-check the installed build to ensure it matches the fixed version for your branch.

Temporary containment if patching is delayed

1. Reduce low-privilege access: remove unnecessary SharePoint accounts and permissions, and ensure only trusted users have roles that would count as “low privilege.”
2. Strengthen credential protection immediately: disable unused accounts, enforce strong passwords/MFA where applicable, and investigate any suspicious logins.
3. Monitor for signs of abuse: look for unusual SharePoint behavior consistent with forced internal requests and unexpected permission/access changes.

What to monitor after patching

1. SharePoint logs for authentication anomalies (new or suspicious low-privilege logins).
2. Any security-relevant events around permission changes or access spikes.
3. System health for disruption that could indicate attempted exploitation.

CISA due date

Not provided for this CVE (it is not listed in the CISA KEV set in the findings).

CVE-2026-70324 is classified as an elevation of privilege issue in Microsoft SharePoint across the listed server editions. The mechanism described in the findings is that a low-privilege authenticated user can force the server to initiate connections to internal resources/services; this “force server to connect internally” behavior enables privilege escalation to full control. The weakness aligns with CWE-918.

Exploitation status: not listed in CISA KEV, and the provided news/press materials do not attribute exploitation to this specific CVE. No public exploit code was found in the provided findings, but PULSE indicates the topic is new and patch-related, with mention of a likely threat actor context.

Likelihood signals: EPSS is provided as a prediction with a flat trend, but this is not presented as proof of real-world exploitation. Because KEV is not listed and no dated exploitation claim is present in the findings, public exploit maturity is not confirmed here.

Practical exposure: reachable in default configuration per the findings, with the key gate being that the attacker must already be authenticated and able to operate as a low-privilege user—no user interaction is required.