Microsoft SharePoint: 21 Vulnerabilities Disclosed, Ranging from RCE to Privilege Escalation
Microsoft SharePoint: 21 vulnerabilities disclosed on August 11, 2026, including critical flaws in deserialization and authentication, with potential for remote code execution and privilege escalation.
Key findings
- Microsoft SharePoint: 21 vulnerabilities disclosed on August 11, 2026, impacting multiple components.
- Multiple critical flaws involve deserialization of untrusted data, enabling remote code execution.
- Cross-site scripting and improper authentication vulnerabilities also present, allowing for spoofing and privilege escalation.
- All disclosed vulnerabilities have been patched by Microsoft.
- Prompt patching is essential to mitigate risks of RCE and privilege escalation in SharePoint environments.
On August 11, 2026, Microsoft released a significant security update addressing 21 vulnerabilities in Microsoft Office SharePoint. The batch, disclosed simultaneously, includes a mix of critical and high-severity flaws, primarily revolving around deserialization of untrusted data and improper input validation, with potential impacts ranging from remote code execution to privilege escalation and spoofing.
A prominent theme within this batch is the deserialization of untrusted data, affecting multiple SharePoint components. CVE-2026-70321, CVE-2026-66808, CVE-2026-66805, CVE-2026-65665, CVE-2026-65663, CVE-2026-65658, CVE-2026-64901, and CVE-2026-63514 all fall under this category, with attackers potentially able to execute code over a network. Another critical vulnerability, CVE-2026-62827, involves improper authentication, allowing an authorized attacker to elevate privileges.
Cross-site scripting (XSS) vulnerabilities are also present, with CVE-2026-64900, CVE-2026-64902, CVE-2026-64897, and CVE-2026-57105 allowing authorized attackers to perform spoofing. Additionally, CVE-2026-64921 highlights a missing authentication for a critical function, enabling privilege escalation. Other vulnerabilities include incorrect authorization (CVE-2026-63514), improper input validation (CVE-2026-62917), insufficient credential protection (CVE-2026-62839), relative path traversal (CVE-2026-62837), and server-side request forgery (CVE-2026-58639).
While the provided information does not specify active exploitation of these particular SharePoint vulnerabilities in the wild, Microsoft's August 2026 Patch Tuesday update, which included these CVEs, addressed a total of 421 vulnerabilities, with 62 marked as critical. Security researchers from Rapid7 and Tenable noted that Microsoft considers exploitation of some vulnerabilities more likely, and the overall update included patches for a wide array of Microsoft products.
Microsoft has provided patches for all disclosed vulnerabilities. Users are strongly advised to apply the latest security updates for Microsoft Office SharePoint to mitigate the risks associated with these flaws. The affected versions and specific patch details can be found in Microsoft's official security advisories.
This coordinated disclosure of numerous vulnerabilities underscores the importance of timely patching for Microsoft SharePoint environments. The concentration of high-severity flaws, particularly those allowing for remote code execution and privilege escalation, presents a significant risk to organizations relying on SharePoint for their operations. Staying vigilant and applying security updates promptly is crucial to maintaining a secure infrastructure.
The batch includes the following CVE IDs: CVE-2026-70321, CVE-2026-66808, CVE-2026-66805, CVE-2026-65665, CVE-2026-65663, CVE-2026-65658, CVE-2026-64921, CVE-2026-64902, CVE-2026-64901, CVE-2026-64900, CVE-2026-64897, CVE-2026-63516, CVE-2026-63514, CVE-2026-63512, CVE-2026-62917, CVE-2026-62839, CVE-2026-62837, CVE-2026-62829, CVE-2026-62827, CVE-2026-58639, CVE-2026-57105.