CVE-2026-70324

This vulnerability lets someone who already has a low-level account on SharePoint trick the server into reaching out to internal systems/services that it shouldn’t. By abusing that “server makes the request” behavior, the attacker can then take much higher control—up to full control of the SharePoint server. Think of it like giving a junior employee a phone extension; they can use it to place calls into restricted back-office lines and then act with much greater authority.

This matters to you if you use or host Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition. The risk is specifically for situations where an attacker already has an authenticated low-privilege account on SharePoint (no click or other user action is needed). Given it’s reachable in default configuration, you should assume it’s a real concern whenever such an account exists—especially if attackers might be able to log in (for example, via compromised credentials).

This is urgent because it lets an attacker with a low-privilege SharePoint account force the server to make internal requests and then gain full control. The traffic-light verdict is RED, and the only practical way to stop it is to install the fixed SharePoint updates for your version.