CVE-2026-62917

This is a SharePoint security bug where an attacker who already has a low-level account can trick the system into acting as if a request is coming from someone else. Think of it like forging the handwriting on a request slip—SharePoint may treat it as legitimate even though it shouldn’t.

This matters if your business runs Microsoft SharePoint Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition, or sharepoint server. The key requirement is that an attacker must already be an authorized user with low privileges, and user interaction is required. Because exploitation depends on having access inside your environment, the risk is highest when low-privilege accounts are reachable by attackers (for example, through compromised accounts) and the vulnerable behavior can be triggered.

This is RED because SharePoint spoofing can let a low-privileged, authenticated attacker impersonate requests, and a sophisticated threat actor (Lazarus group) is associated with the activity noted in the feed. Even though a fully public exploit isn’t shown in the findings, you should still treat this as urgent to reduce the chance of misuse from a compromised account. Patch promptly for all affected SharePoint builds.

Confirm exposure

• Identify which product you run (Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition, or sharepoint server).
• Check the current SharePoint build/version.
• Mark any instance where the build is older than the fixed versions below.

Apply the fix

• SharePoint Server 2016: update to 16.0.5565.1001
• SharePoint Server 2019: update to 16.0.10417.20198
• SharePoint Server Subscription Edition / sharepoint server: update to 16.0.19725.20522

Use Microsoft’s MSRC guidance for the exact update packages and rollout steps:

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62917

Workaround if patching is delayed

• Reduce the chance a low-privileged account can be abused: review accounts with low SharePoint permissions, disable or remove unused accounts, and tighten access controls so only intended users can reach the relevant SharePoint features.
• Because the findings state user interaction is required, monitor for suspicious user-driven attempts around SharePoint features that accept or process user-supplied input.

After patching

• Re-check the SharePoint build matches the fixed version for the appropriate edition.
• Review logs for unusual authentication or request patterns from low-privilege accounts around the time of user actions.

Due date

• KEV listing was not provided for this CVE, so no CISA due date is included in the findings.

CVE-2026-62917 is a spoofing vulnerability (CWE-20: Improper Input Validation) in Microsoft SharePoint Server. The mechanism described in the findings is that a low-privileged, authenticated attacker can exploit improper input validation over the network to impersonate or forge requests, and user interaction is required to trigger the vulnerable behavior. The findings do not list this CVE in CISA KEV and do not report a clear dated exploitation claim in press, and there is no public exploit code on record. A patch is available with specific fixed builds per edition (2016: 16.0.5565.1001; 2019: 16.0.10417.20198; Subscription/Sharepoint server: 16.0.19725.20522). EPSS is provided as a low predicted likelihood, but exploitation confidence is driven by the RED verdict and the associated actor note (Lazarus group) in the feed. KEV not listed here means there is no confirmed CISA-tracked exploitation signal in the provided findings.