CVE-2026-108452
8.8HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-22
Impact
Authenticated attackers with network access can execute arbitrary code on the SharePoint server. They only need standard user credentials to exploit the path traversal vulnerability.
Root cause
Improper limitation of a pathname to a restricted directory (path traversal) in Microsoft Office SharePoint allows unauthorized file access and execution.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Install the security update from the Microsoft Security Update Guide advisory; if immediate patching is not possible, restrict SharePoint network access to trusted administrative IP addresses and audit user upload permissions.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.