Loading vulnerability…
Microsoft SharePoint Cryptographic Signature Verification Privilege Escalation
CVE-2026-102866 is an elevation-of-privilege vulnerability in Microsoft Office SharePoint caused by improper verification of cryptographic signatures. An unauthenticated remote attacker who obtains a valid proof token for a targeted user can modify the token and submit it to an affected SharePoint server to authenticate as that user. Exploitation requires specific protocol settings or configurations but no user interaction. Microsoft rates the vulnerability Critical, with a CVSS v3.1 base score of 8.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables impersonation of the targeted user and unauthorized access to or modification of SharePoint content available to that account. The resulting access depends on the compromised user's permissions; a specific administrative privilege level is not established. The CVSS assessment indicates potentially high confidentiality, integrity, and availability impacts.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround or interim mitigation is identified. The protocol settings or configurations required for exploitation are not specified, so a configuration-based workaround cannot be established.
Patch, then assume compromise.
Apply the applicable Microsoft security update to affected SharePoint installations. For SharePoint Server Subscription Edition, install the October 2026 security update KB5002927, which provides version 16.0.20326.20190, or a later applicable security update. Verify update applicability for other affected SharePoint editions using Microsoft's vulnerability-specific security guidance.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.