Microsoft Office SharePoint: 25 Vulnerabilities Disclosed, Including Path Traversal and RCE
Key findings • 25 Microsoft Office SharePoint CVEs disclosed Oct 13-15, 2026, including high-severity flaws. • Vulnerabilities include path traversal, SQL injection, XSS, SSRF, and privilege …
Key findings
- 25 Microsoft Office SharePoint CVEs disclosed Oct 13-15, 2026, including high-severity flaws.
- Vulnerabilities include path traversal, SQL injection, XSS, SSRF, and privilege escalation.
- Multiple flaws allow for remote code execution and sensitive information disclosure.
- Microsoft has released security updates addressing all disclosed vulnerabilities.
- Prompt patching is critical to mitigate risks associated with these flaws.
- The batch covers a wide range of attack vectors affecting SharePoint.
On October 13, 2026, a significant batch of 25 vulnerabilities was disclosed for Microsoft Office SharePoint, spanning a two-day window and including several high-severity flaws. These vulnerabilities, detailed across multiple CVE entries, present a range of risks including path traversal, missing authorization, cross-site scripting (XSS), observable discrepancies, privilege escalation, server-side request forgery (SSRF), and deserialization of untrusted data. The sheer volume and severity of these issues underscore a critical security posture for organizations relying on SharePoint.
Several vulnerabilities center on authorization and access control. CVE-2026-88164, CVE-2026-96044, CVE-2026-88198, CVE-2026-70246, and CVE-2026-105720 all involve missing or incorrect authorization, potentially allowing attackers to elevate privileges. CVE-2026-70217, a medium-severity flaw, also relates to improper access control, enabling information disclosure.
Path traversal vulnerabilities are another notable theme, with CVE-2026-108452, CVE-2026-85932, CVE-2026-70298, and CVE-2026-69943 allowing attackers to execute code or disclose information by manipulating file paths.
Cross-site scripting (XSS) vulnerabilities, which can lead to spoofing, are present in CVE-2026-97783, CVE-2026-88206, CVE-2026-88208, and CVE-2026-88204. These flaws could enable attackers to impersonate legitimate users or inject malicious content into web pages.
Server-side request forgery (SSRF) is a critical concern highlighted by CVE-2026-88208, CVE-2026-70251, and CVE-2026-70202, which could allow attackers to make the server send requests to unintended locations, potentially leading to privilege escalation or information disclosure.
Other significant vulnerabilities include CVE-2026-88155, a heap-based buffer overflow, and CVE-2026-88166, an integer overflow, both of which could lead to code execution. CVE-2026-85900 involves deserialization of untrusted data, also posing a code execution risk. CVE-2026-70267, an inclusion of functionality from untrusted control sphere, and CVE-2026-70266, a SQL injection vulnerability, further expand the attack surface. CVE-2026-88200, a privilege context switching error, and CVE-2026-97782, an observable discrepancy, round out the disclosed issues.
Microsoft has released security updates to address these vulnerabilities. Users are strongly advised to apply the latest patches and review Microsoft's official security advisories for detailed information on affected versions and mitigation strategies. The broad range of vulnerabilities, from path traversal to SQL injection and SSRF, necessitates a comprehensive review of security configurations and prompt patching to protect against potential exploitation.
The coordinated disclosure of these 25 vulnerabilities highlights the ongoing security challenges faced by complex enterprise software like Microsoft Office SharePoint. Organizations must remain vigilant, ensuring their systems are up-to-date and that security best practices are rigorously followed to defend against the diverse array of threats. The timely application of patches and a thorough understanding of the potential impact of each vulnerability are crucial steps in maintaining a secure SharePoint environment.
The sheer number of high-severity flaws disclosed together indicates a potential systemic issue that requires immediate attention from administrators. Proactive security measures, including regular vulnerability scanning and penetration testing, can help identify and remediate weaknesses before they can be exploited by malicious actors.
This batch of vulnerabilities serves as a stark reminder of the importance of a robust patch management program. Delaying updates can leave systems exposed to known exploits, potentially leading to data breaches, service disruptions, and reputational damage.
Administrators should prioritize patching the most critical vulnerabilities first, particularly those that allow for remote code execution or privilege escalation. A phased rollout of patches, combined with thorough testing, can help minimize the risk of introducing new issues while ensuring that critical security gaps are closed.
The disclosure of these vulnerabilities across a two-day period suggests a coordinated effort to bring these issues to light, emphasizing the need for rapid response from both vendors and users. Microsoft's commitment to addressing these flaws through timely updates is a positive step, but the responsibility ultimately lies with organizations to implement these fixes effectively.
The variety of vulnerability types—from classic flaws like XSS and SQL injection to more modern concerns like SSRF and deserialization—demonstrates the multifaceted nature of modern cybersecurity threats. A holistic security strategy that addresses all potential attack vectors is essential for protecting sensitive data and maintaining operational continuity.
Given the severity and number of these vulnerabilities, it is imperative that organizations conduct a thorough risk assessment to understand their specific exposure and to implement appropriate security controls. This includes not only patching but also reviewing access controls, network segmentation, and other security measures that can help mitigate the impact of any potential breaches.
The disclosure of CVE-2026-108452, CVE-2026-88164, CVE-2026-97783, CVE-2026-97782, CVE-2026-96044, CVE-2026-88209, CVE-2026-88208, CVE-2026-88206, CVE-2026-88204, CVE-2026-88200, CVE-2026-88198, CVE-2026-88166, CVE-2026-88155, CVE-2026-85932, CVE-2026-85900, CVE-2026-70298, CVE-2026-70267, CVE-2026-70266, CVE-2026-70259, CVE-2026-70251, CVE-2026-70246, CVE-2026-70217, CVE-2026-70202, CVE-2026-69943, and CVE-2026-105720 highlights the critical need for prompt security updates for Microsoft Office SharePoint. The batch includes multiple high-severity flaws, such as path traversal, missing authorization, XSS, SSRF, and code execution vulnerabilities, discovered between October 13 and October 15, 2026. These vulnerabilities could allow attackers to execute code, elevate privileges, or disclose sensitive information. Microsoft has released patches, and users are urged to apply them immediately to mitigate these risks.
Key findings include:
- A batch of 25 CVEs for Microsoft Office SharePoint disclosed between October 13-15, 2026.
- Multiple high-severity vulnerabilities including path traversal, SQL injection, and SSRF.
- Flaws enabling privilege escalation and remote code execution were part of the disclosure.
- Microsoft has released security updates to address all disclosed vulnerabilities.
- Prompt patching is essential to protect against exploitation of these flaws.
- The vulnerabilities span various attack vectors, including XSS and deserialization issues.
The vulnerabilities disclosed for Microsoft Office SharePoint between October 13-15, 2026, represent a significant security event. The batch includes a wide array of high and medium severity flaws, such as path traversal, SQL injection, cross-site scripting, and server-side request forgery. The presence of multiple critical vulnerabilities that could lead to code execution or privilege escalation underscores the urgent need for administrators to apply the security updates released by Microsoft. The coordinated disclosure of these 25 CVEs highlights the importance of a proactive security strategy, including regular patching and vulnerability management, to safeguard sensitive data and maintain the integrity of SharePoint environments.
A stylized representation of a Microsoft SharePoint server rack, with several server units showing warning symbols and data streams leaking out, against a backdrop of binary code.