Advisory · CVE-2026-102866
Signature verification flaw in SharePoint Server can let an unauthenticated attacker affect data
Microsoft SharePoint Server does not properly verify cryptographic signatures, which an unauthenticated attacker can use to affect data over the network. Microsoft rates it CVSS 3.1 8.1.
- Vendor
- Microsoft
- Product
- Microsoft SharePoint Server
- Identifier / CWE
- CVE-2026-102866
CWE-347 - Action timing
- Immediate
Explain it like I’m five
SharePoint can be fooled about a cryptographic signature, so data it should have rejected as untrusted gets through.
- 01Attacker engages the component
A remote or authorized attacker sends crafted content or requests to Microsoft SharePoint Server.
- 02Weakness triggers
The component mishandles the input and the flaw takes effect.
- 03Impact lands
The attacker gains the execution, elevation, or access the flaw allows.
What happened
Microsoft disclosed CVE-2026-102866 in its October 2026 update guide: improper verification of a cryptographic signature (CWE-347) in Microsoft Office SharePoint can let an unauthenticated attacker affect data over the network. Microsoft’s affected data includes SharePoint Server Subscription Edition builds before 16.0.20326.20190.
Microsoft lists the affected releases and their patched build thresholds in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.
What to do
- Inventory every Microsoft SharePoint Server deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Microsoft SharePoint Server while remediation is underway, especially for internet-facing instances.
- Review application and server logs for privilege changes, new site administrators, and SharePoint actions by accounts outside their usual scope.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
SharePoint holds the documents everyone forgot they shared. Privilege elevation there is a data-governance incident as much as a patch item.