Privilege Escalation in Microsoft SharePoint Server

Successful exploitation allows an unauthenticated remote attacker to elevate privileges within the affected SharePoint environment. This can enable unauthorized access to higher-privileged SharePoint functionality and administrative capabilities, increasing the risk of broader compromise of the SharePoint server and associated content or services.

Identify all on-premises SharePoint Server instances, especially those exposed to the internet, and reduce or eliminate direct internet exposure where possible. Limit access to SharePoint Central Administration and other management interfaces. Enable AMSI integration for SharePoint web applications and configure AMSI Request Body Scan Mode to Full Mode where feasible. Monitor for unusual requests, unauthorized authentication attempts, unexpected privilege escalation, suspicious access to IIS machine keys, malicious processes, web shell activity, deserialization attack indicators, and security detections associated with SharePoint exploitation.

Apply the vendor security updates for affected SharePoint deployments. Fixed versions are Microsoft SharePoint Enterprise Server 2016 version 16.0.5561.1001, Microsoft SharePoint Server 2019 version 16.0.10417.20175, and Microsoft SharePoint Server Subscription Edition version 16.0.19725.20434. Organizations running SharePoint Server 2016 or 2019 should also plan migration to a supported version because those products reached end of life on July 14, 2026.