Microsoft discloses SharePoint privilege‑escalation flaw CVE-2026-96044

Microsoft disclosed CVE-2026-96044 (Common Vulnerabilities and Exposures), a privilege‑escalation flaw affecting Microsoft Office SharePoint Server, on 13 October 2026. (according to S2)

The vulnerability carries a CVSS score of 8.8 out of 10 and Microsoft rates it as Important. (according to S3) Microsoft assigns the vulnerability the CWE‑269 Improper Privilege Management identifier. (according to S2) Exploitation can result in high impact to confidentiality, integrity, and availability, and a low‑privileged authenticated user may raise privileges network‑wide without user interaction. (according to S2) No attacks have been reported for CVE-2026-96044. (according to S3)

The flaw is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. (according to S6) No confirmed public exploit exists for CVE-2026-96044. (according to S6)

The NVD entry (National Vulnerability Database) for CVE-2026-96044 was dated 13 October 2026 and last updated on 14 October 2026. (according to S2) Microsoft released the Security Update Guide advisory for the flaw on 13 October 2026 and disclosed the vulnerability through that guide. (according to S2) Microsoft added the CVE to its security update guidance as an informational change that includes the CWE‑269 identifier. (according to S7) (according to S2)

Administrators should apply security update KB5002927 (Knowledge Base) version 16.0.20326.20190 for Microsoft SharePoint Server Subscription Edition to mitigate the flaw. (according to S3) (according to S2) SharePoint Online in Microsoft 365 is already patched by Microsoft, so customers do not need to update it themselves. (according to S3) (according to S2) To determine exposure, administrators can check the farm build number using (Get‑SPFarm) (a PowerShell cmdlet that returns the farm’s build version).BuildVersion in the SharePoint Management Shell (a command‑line interface for managing SharePoint) or Central Administration (the web‑based management console for SharePoint). (according to S3) (according to S2) If the build equals or exceeds the fixed build, the vulnerability is considered patched; otherwise, the update must be applied to each server and the SharePoint Products Configuration Wizard (a tool that applies configuration changes to SharePoint) or PSConfig.exe (the SharePoint Products Configuration Wizard executable) run with the given parameters. (according to S3) (according to S2)

Install the security update cited in the Security Update Guide on every affected SharePoint Server system. (according to S2) Create an inventory of SharePoint Server releases and patch internet‑connected or multi‑tenant farms first. (according to S2) Change passwords for service and farm administrator accounts when unusual privilege shifts occur. (according to S2) Limit SharePoint account creation to the lowest privileges necessary for required tasks. (according to S2)

Deploy the cumulative update for SharePoint Server Subscription Edition from the vendor and confirm installation using SharePoint Central Administration. (according to S2) Confine SharePoint access to trusted network zones via firewalls or reverse‑proxy allow lists while patches are pending. (according to S2) Apply conditional access rules that require device compliance and multifactor authentication for anyone signing in to SharePoint. (according to S2) Review SharePoint accounts, delete unused or excessively privileged accounts, and reduce the attacker’s target set. (according to S2)

After updating, verify the farm build number and product version using SharePoint management commands. (according to S2) Link SharePoint audit logs with identity provider (IdP) sign‑in logs to detect privilege changes originating from low‑level accounts. (according to S2) Establish a baseline of normal admin API calls per account and alert when usage deviates from SharePoint REST API endpoints (_api/web, _api/site, or _vti_bin). (according to S2) Look for abrupt shifts in role assignments or permission inheritance that occur outside scheduled maintenance windows. (according to S2)

Send SharePoint ULS logs (Unified Logging Service logs), IIS access logs (Internet Information Services logs), and Windows Security events (Windows Security event logs) to a central analytics system for correlation. (according to S2) Monitor outbound traffic from SharePoint hosts that could signal data staging or movement after a compromise. (according to S2) Inspect Entra ID (identity and access management service) and Active Directory logs for privilege modifications that correlate with suspicious SharePoint activity. (according to S2) Alterations to SharePoint permissions, groups, or site admin roles made by regular users may indicate compromise. (according to S2)

Successful exploitation requires only low privileges and no user interaction. (according to S2) Affected products include SharePoint Server that exposes authenticated endpoints to internal users and to federated or hybrid authentication environments. (according to S2) Organizations should evaluate whether they were exposed before the patch became available. (according to S6) Defenders should monitor threat feeds for new information and deploy vendor updates promptly. (according to S6)