CVE-2026-108452: how an authenticated SharePoint attacker can reach code execution

Microsoft has assigned CVE-2026-108452 to a remote code execution condition in Microsoft Office SharePoint. The vendor's CVE record classifies the defect as CWE-22, improper limitation of a pathname to a restricted directory. An attacker who already has some network access and authorization can use the flaw to execute code on an affected server.

Vulnerability overview

The CVE record gives the issue a CVSS 3.1 base score of 8.8 and rates it High. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. That means the vulnerable path is reachable over the network, attack complexity is rated low, the attacker needs low privileges, and no user interaction is required. The confidentiality and integrity impacts are High, while availability is not changed in the vendor vector.

The title and CWE classification point to a containment failure: a pathname that should remain inside a restricted directory can reach a location outside it. Microsoft states that the result is code execution. The public record does not identify the exact vulnerable request, endpoint, or file operation, so defensive work should not assume that one particular SharePoint feature is the only path to the condition.

Exploitation conditions

This is not an unauthenticated internet-wide exploit in the published description. The attacker is described as authorized, and the CVSS privilege requirement is Low. A useful threat model therefore starts with a user or service identity that can reach a vulnerable SharePoint workload, then asks what that identity can ask the server to process. A low-privileged account, another compromised identity, or an improperly delegated application could matter if it can supply the input that reaches the faulty path handling.

The record does not say that every authenticated user can exploit every deployment. It also does not publish a proof-of-concept chain. Those gaps should remain visible in detection engineering and incident review.

Impact

Successful exploitation could give an attacker code execution in the context available to the vulnerable SharePoint process or component. The practical severity depends on the farm's permissions, application pools, integrations, and network reach. A SharePoint server often holds more than document libraries: it can have access to service accounts, connected applications, workflow infrastructure, and internal data stores. That concentration raises the value of an authenticated foothold even when the initial account has limited rights.

Affected products and scope

The CVE record lists Microsoft SharePoint Server Subscription Edition on x64 systems. The affected version range begins at 16.0.0 and ends before 16.0.20326.20190. Microsoft's update documentation identifies KB5002927, released October 13, 2026, as a security update that brings the build to 16.0.20326.20190.

Teams should verify the installed build rather than infer patch state from the product name. SharePoint deployments can include multiple servers, workflow components, and language packages. Microsoft's guidance says installations that run SharePoint Workflow Manager need KB5002799 before the main security update. Classic Workflow Manager installations also require a documented debug flag step before the update can proceed.

Exposure context

ZoomEye returned 163,243 matches for the product-fingerprint query app="Microsoft SharePoint" when checked on November 3, 2026. The CVE-specific filter vul.cve="CVE-2026-108452" returned 0. The larger product count is Exposure evidence, not a count of vulnerable SharePoint servers. A product fingerprint cannot prove the exact build, installed update level, configuration, or exploitability of any asset.

The useful next step is to compare the internet-visible population with internal inventory. Treat an externally reachable SharePoint Subscription Edition host below the fixed build as a higher-priority verification target, especially when low-privileged or delegated identities can reach it.

Remediation and mitigations

Apply KB5002927 according to Microsoft's SharePoint deployment guidance and verify the farm reports build 16.0.20326.20190 or later. Complete any prerequisite Workflow Manager update before the main patch. After installation, confirm that every farm server and relevant workflow component has the expected build.

Until patching is complete, reduce unnecessary network access to SharePoint administration and authoring surfaces, review delegated permissions, and increase monitoring for unexpected server-side file activity or unusual requests from low-privileged identities. These measures do not replace the vendor update, and the available sources do not provide a tested workaround.

References

1. Microsoft Security Update Guide, CVE-2026-108452
2. Microsoft Support, KB5002927 SharePoint Server Subscription Edition
3. Microsoft Learn, SharePoint updates
4. CVE Program, CVE-2026-108452 record