CVE-2026-102862: Microsoft Office SharePoint Elevation of Privilege Vulnerability

Overview

Severity

High (CVSS 8.8)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Category

Elevation of Privilege

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2026-Oct

Released

2026-10-13

Description

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

FAQ

Is the Preview Pane an attack vector for this vulnerability? No, the Preview Pane is not an attack vector. What privileges could an attacker gain with a successful exploitation? Due to default configurations, an unprivileged user could get Site Owner Permissions, allowing the attacker to use this vulnerability to inject arbitrary code into the server.

Affected Products (1)

Microsoft Office

• Microsoft SharePoint Server Subscription Edition

Security Updates (1)

• 5002927

Acknowledgments

41ae55e9310ff27fa6f26af4727e5590

Revision History

• 2026-10-13: Information published.