CVE-2026-102865: Microsoft Office SharePoint Information Disclosure Vulnerability

Overview

Severity

Medium (CVSS 6.5)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

Category

Information Disclosure

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2026-Oct

Released

2026-10-13

Description

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

FAQ

Is the Preview Pane an attack vector for this vulnerability? No, the Preview Pane is not an attack vector. What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is file content.

Affected Products (1)

Microsoft Office

• Microsoft SharePoint Server Subscription Edition

Security Updates (1)

• 5002927

Acknowledgments

pwnky

Revision History

• 2026-10-13: Information published.