Advisory · CVE-2026-88164
Missing authorization in SharePoint Server can elevate an authorized user's privileges
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. Microsoft rates CVE-2026-88164 CVSS 3.1 8.8 for SharePoint Server Subscription Edition before 16.0.20326.20190.
- Vendor
- Microsoft
- Product
- Microsoft SharePoint Server
- Identifier / CWE
- CVE-2026-88164
CWE-862 - Action timing
- Immediate
Explain it like I’m five
A signed-in user can act beyond their role because the authorization check simply is not there.
- 01Authorized access
An attacker with a valid SharePoint account reaches the affected function.
- 02Authorization check missing
SharePoint does not perform the authorization check the action requires.
- 03Privileges elevated
The attacker acts with rights beyond their role across the network-facing service.
What happened
Microsoft disclosed CVE-2026-88164 in its security update guide: missing authorization (CWE-862) in Microsoft Office SharePoint can let an authorized attacker elevate privileges over a network. Microsoft’s affected data lists SharePoint Server Subscription Edition builds before 16.0.20326.20190.
Apply the October 2026 SharePoint security update for your build rather than relying on a version guess here.
What to do
- Inventory every Microsoft SharePoint Server deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Microsoft SharePoint Server while remediation is underway, especially for internet-facing instances.
- Review application and server logs for privilege changes, new site administrators, and SharePoint actions by accounts outside their usual scope.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
One more SharePoint privilege flaw in a month that already had several. Keep SharePoint on the urgent ring and audit site administrators after patching.