CVE-2026-62839

Think of SharePoint like a receptionist that verifies who you are before giving access. This flaw lets an attacker (if they already have some access) present the system as if they are a different, trusted person—like showing a fake badge. That can lead to impersonation and unauthorized access to what the impersonated user could reach.

This matters if you run Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition, or sharepoint server.

It’s most relevant when an attacker already has some authorization/access to the SharePoint system (the findings indicate low prerequisites and no user interaction). It is also network-reachable in the Microsoft Office SharePoint setup, so systems exposed to the internet or internal users should be treated as higher concern.

This is RED because an identity-spoofing weakness can enable impersonation once an attacker has gained some access, and the vulnerability is being addressed via a recent Microsoft patch release. Even without confirmed public exploit code or a KEV listing, the combination of network reachability and account impersonation risk makes it urgent to fix.

1. Confirm whether you’re running an affected product: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition, or sharepoint server.
2. Determine your exact SharePoint build/version on each server.
3. Decide if you need to patch by comparing to the fixed versions:
   • SharePoint Enterprise Server 2016: fixed in 16.0.5565.1001
   • SharePoint Server 2019: fixed in 16.0.10417.20198
   • SharePoint Server Subscription Edition / sharepoint server: fixed in 16.0.19725.20522
4. Patch using Microsoft’s official update for CVE-2026-62839 from the Update Guide, then re-check the SharePoint build/version to confirm you’re on the fixed level.
5. Temporary mitigation if patching is delayed:
   • Reduce who can reach SharePoint over the network (tighten firewall/proxy rules and restrict inbound access to only what your business needs).
   • Review access to SharePoint and remove/disable any accounts or sessions that you do not recognize, since the findings indicate the attacker needs some existing authorization/access rights.
6. Post-patch monitoring: watch for suspicious identity/role behavior in SharePoint (unexpected user actions, changes that look like they were performed by someone else, or unusual access from unfamiliar sources).

CVE-2026-62839 is a network-reachable identity spoofing vulnerability in Microsoft Office SharePoint (CWE-522). The mechanism described in the findings is that insufficiently protected credentials allow an attacker who already has authorization/access to trick the system or other users by presenting false identity information over the network, with no user interaction required.

KEV: not listed in CISA KEV. Public exploit code: none reported in the provided findings. Press reporting: no clear dated claim tying this specific CVE to active exploitation; articles mention another SharePoint vulnerability (CVE-2026-68820) as actively exploited, but do not specifically name CVE-2026-62839.

EPSS is provided as a prediction (0.6%) with a flat trend; per the rules, this should not be treated as evidence of real-world exploitation.

Patch status: fixed versions are published by Microsoft for SharePoint Enterprise Server 2016 (16.0.5565.1001), SharePoint Server 2019 (16.0.10417.20198), and SharePoint Server Subscription Edition / sharepoint server (16.0.19725.20522).