CVE-2026-96044: 
Microsoft SharePoint Server Subscription Edition vulnerability analysis and mitigation

CVE-2026-96044 is a privilege escalation vulnerability in Microsoft Office SharePoint that allows an authorized attacker with low privileges to elevate their access over a network. It affects Microsoft SharePoint Server Subscription Edition versions from 16.0.0 up to (but not including) 16.0.20326.20190. Microsoft disclosed and patched this vulnerability on October 13, 2026, as part of its monthly security update cycle. It carries a CVSS v3.1 base score of 8.8 (High) (Microsoft MSRC).

The vulnerability is classified under CWE-269 (Improper Privilege Management), indicating that SharePoint fails to properly restrict or validate privilege levels for authenticated users performing certain network-accessible operations. An attacker with a low-privileged account can exploit this flaw over the network without requiring user interaction, making it particularly dangerous in environments where many users have basic SharePoint access. The attack complexity is low, meaning no special conditions or race conditions are required to trigger the vulnerability. No CWE was formally assigned by Microsoft in their advisory description, though the NVD mapping identifies CWE-269 (Microsoft MSRC).

Successful exploitation grants an attacker elevated privileges within the SharePoint environment, with high impact to confidentiality, integrity, and availability. A low-privileged authenticated user could gain administrative-level access, potentially exposing sensitive documents and data stored in SharePoint, modifying or deleting content, and disrupting service availability. The network-based attack vector means exploitation does not require local access, increasing the risk of abuse by insider threats or compromised low-privilege accounts (Microsoft MSRC).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Microsoft MSRC). The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable. The EPSS score is 0.0, reflecting a currently low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time.

Microsoft has released a security update addressing this vulnerability. Organizations running Microsoft SharePoint Server Subscription Edition should update to version 16.0.20326.20190 or later immediately. The patch is available through the Microsoft Security Response Center update guide. Given the low attack complexity and network accessibility, patching should be prioritized, particularly for internet-facing or multi-tenant SharePoint deployments (Microsoft MSRC).

The Zero Day Initiative (ZDI) included CVE-2026-96044 in their October 2026 Patch Tuesday security update review (ZDI Blog). Coverage has also appeared in threat radar aggregators noting the SharePoint Office vulnerabilities patched in this cycle. No significant independent researcher commentary or social media discussion has been identified beyond standard Patch Tuesday coverage.