CVE-2026-62827

This vulnerability is like a locked door that still lets someone with a key raise their access level. If an attacker already has some legitimate access to your SharePoint environment, they may be able to turn that into higher privileges, which can lead to more access than they should have.

This matters if you run Microsoft SharePoint Server (including SharePoint Server Enterprise 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition). Because the flaw is described as involving “authorized” attackers, the bigger risk is when an attacker can already reach or access your SharePoint environment (for example, valid credentials or an already-compromised account). This is a network-access issue, so it matters most when your SharePoint is reachable from untrusted networks or when attackers can authenticate to it.

Mark this as RED because Microsoft has provided fixes and there is new security attention around the patch, including activity attributed to the Lazarus group. Even without confirmed public exploit code, elevation-of-privilege flaws are high-impact in SharePoint because they can expand what an attacker can do once they have a foothold. Act quickly to move to the fixed SharePoint build for your edition.

Confirm whether you’re affected

1. Identify your SharePoint edition (SharePoint Server, SharePoint Enterprise Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition).
2. Find your SharePoint build number on the server (IT normally checks SharePoint/Windows build details and the SharePoint product build).
3. Compare to the Microsoft fixed versions:
   • SharePoint Server: fixed in 16.0.19725.20522
   • SharePoint Enterprise Server 2016: fixed in 16.0.5565.1001
   • SharePoint Server 2019: fixed in 16.0.10417.20198
   • SharePoint Server Subscription Edition: fixed in 16.0.19725.20522
4. If your build is below the fixed version for your edition, you should treat your environment as affected.

Upgrade / patch (target state)

1. Follow Microsoft’s patch guidance for CVE-2026-62827 from the Microsoft Update Guide.
2. Apply the update for your specific SharePoint edition.
3. Re-check the SharePoint build number after installation to verify it matches the fixed release.

Temporary risk reduction (if patching is delayed)

1. Tighten access to SharePoint so only required users and approved accounts can reach and authenticate to it.
2. Review for signs of account compromise (unexpected logins, privilege changes, unusual admin actions) and disable any suspicious accounts immediately.
3. Reduce exposure of SharePoint endpoints to the public internet where feasible (restrict via firewall/VPN/allowlists), since this issue can be triggered over the network.

What to monitor after patching

1. Authentication and authorization events tied to SharePoint activity (especially any changes to permissions or elevated actions).
2. Administrative actions and changes to content access controls.
3. Any continuing alerts or anomalies that could indicate an ongoing compromise.

KEV / exploitation note

• This finding set does not report KEV listing and does not include public exploit code on record, so exploitation is not confirmed in this dataset; however, the presence of official fixes and recent threat-actor attention means you should still patch promptly.

CVE-2026-62827 is an elevation of privilege vulnerability in Microsoft SharePoint Server attributed to improper authentication (CWE-287). The practical mechanism, per the provided description, is that an attacker who is already authorized can use the flaw over the network to elevate privileges. No KEV listing and no public exploit code are noted in the findings provided, so exploit availability is not established here; nevertheless, Microsoft has published fixed builds for all listed SharePoint product lines. The traffic-light verdict for this CVE is RED, indicating high priority for remediation in operational environments where SharePoint is reachable and where attackers may obtain or abuse authenticated access.