CVE-2026-70355

This vulnerability lets someone with a limited SharePoint account trick SharePoint into running malicious code inside a web page. If the victim’s browser loads that page (user interaction), the attacker can use it to gain higher permissions—like becoming an administrator within the SharePoint system. Think of it like leaving a door unlocked and handing a key to anyone who can reach the front desk, then using that key to open the manager’s office.

This matters if your organization runs Microsoft SharePoint Server 2019 or Microsoft SharePoint Server Subscription Edition (or SharePoint Server) and users can reach SharePoint pages that process web input. The weakness requires an attacker to already have low-level SharePoint credentials, plus some user interaction, so it’s most relevant when attackers can obtain a basic account or otherwise get a user to view a malicious page. Final reachability gate: it’s a risk only if an attacker can authenticate to SharePoint with low-level credentials and can involve user interaction (for example, getting a user to load the crafted content).

This is RED because attackers with at least low-level SharePoint access can potentially escalate to higher administrative permissions by injecting malicious scripts through web inputs. Even without public exploit code on record, the presence of credible threat-actor interest (Lazarus group) and the availability of an official patch mean you should treat this as an active, high-priority hardening task. Patch as soon as your change window allows.