CVE-2026-62829

Think of SharePoint as your company’s shared bulletin board and forms system. This bug can let a person who already has a SharePoint login “edit the display” in a way that tricks other users into seeing a fake message or interface, like it’s coming from someone else. That can lead to users clicking unsafe things or doing actions they wouldn’t normally do.

This matters if you run Microsoft SharePoint Server (including Microsoft SharePoint Server 2019 or SharePoint Server Subscription Edition) and any staff, contractors, or services have SharePoint accounts that could influence page content. Because the attacker must have valid credentials for the SharePoint server, it’s mainly a risk from an internal or already-compromised account. Only consider it reachable if an attacker can log in to your SharePoint server and then get content rendered in a way that other users will view.

This is RED because the attacker path requires only a low level of privilege and relies on manipulating what users see in SharePoint, which can enable real impersonation and deception. While there’s no clear public record of exploitation for this exact CVE and it is not listed in CISA KEV, the presence of active cyber-actor patch pressure makes it important to fix quickly. Patch according to Microsoft’s fixed versions without waiting for further reporting.

Confirm whether you’re exposed

1. Identify which product you run: Microsoft SharePoint Server 2019, SharePoint Server, or SharePoint Server Subscription Edition.
2. Check the exact SharePoint version/build currently installed on each SharePoint server.
3. Determine exposure by comparing your installed version to the fixed versions listed below.

Upgrade to the fixed version

• SharePoint Server: update to 16.0.19725.20522
• Microsoft SharePoint Server 2019: update to 16.0.10417.20198
• SharePoint Server Subscription Edition: update to 16.0.19725.20522

Follow Microsoft’s guidance from the official update page for CVE-2026-62829 (msrc link provided in the IT message).

If patching is delayed

• Reduce the risk of abuse by limiting who has SharePoint permissions that can affect what other users see in SharePoint web pages.
• Review active users/accounts on SharePoint and remove unused or overly broad access.
• Treat any newly created or recently changed SharePoint content (pages, links, embedded content) as higher risk until you patch.

What to monitor after the update

• Look for unusual or unexpected changes to SharePoint pages or embedded content.
• Watch for suspicious user interactions (repeated login prompts, odd links, or “impersonation-style” messages) originating from SharePoint.
• Confirm normal SharePoint page rendering after the update.

Exploitation status and timelines

• CISA KEV: not listed.
• Public exploitation reporting for this exact CVE: no clear dated claim provided in the findings.
• Therefore, focus on patching based on the confirmed fix availability and the authenticated nature of the risk.

Caution for users

• Even after patching, report any suspicious SharePoint messages/links to IT immediately, since deception attempts may have occurred using existing content before the update.

CVE-2026-62829 is a SharePoint Server spoofing vulnerability (CWE-79, input neutralization failure) tied to how SharePoint web pages are generated and rendered in browsers. The mechanism described in the findings is the ability for an authenticated user to manipulate browser-rendered content, potentially enabling identity spoofing by deceiving victims into interacting with fraudulent interfaces.

Attack model from findings: network-reachable path, low authentication requirement (attacker must have valid credentials), and user interaction required (victim must view/interact with the affected SharePoint content). There is no availability impact indicated.

Fix availability: Microsoft provides patched builds—16.0.19725.20522 for SharePoint Server and SharePoint Server Subscription Edition, and 16.0.10417.20198 for Microsoft SharePoint Server 2019.

Exploitation maturity: no public exploit code recorded, and no clear dated press/incident attribution provided for this CVE. CISA KEV does not list it. EPSS is provided as a prediction (0.4%, trend flat), but it is not used to override the confirmed need to patch based on available fixes.

Note on actor/pulse: the findings mention heightened patch-related attention with an actor label; however, the findings do not state confirmed exploitation for this specific CVE.