CVE-2026-88155
8.8HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-122
Impact
Authenticated attackers can achieve remote code execution on the SharePoint server. They need valid low-privileged credentials and network access to the SharePoint instance.
Root cause
A heap-based buffer overflow allows memory corruption when handling requests from authenticated users.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Install the Microsoft security update for your SharePoint version referenced in the advisory. If immediate patching is not possible, restrict network access to SharePoint endpoints to trusted users only.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88155PatchVendor Advisory