CVE-2026-64921

Think of SharePoint like the office building where documents are stored. This vulnerability is like a door guard problem that can let someone move from “allowed visitor” to “trusted staff” by gaining higher permissions. Once that happens, they may be able to view or manage more than they should—and they can potentially disrupt normal operations.

This matters if you run Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition (including “sharepoint server” deployments). The weakness is specifically about elevating privileges, so it targets organizations that rely on SharePoint for sensitive documents and business workflows.

This is primarily a risk when an attacker can reach the SharePoint environment and can get an authorized position (for example, credentials or access inside the environment are the likely starting point).

This is RED because it’s a high-impact privilege-escalation issue in widely used SharePoint Server software, and Microsoft has already released fixed versions. Recent security attention also points to interest from the Lazarus group, increasing the practical risk.

Even though there’s no public exploit code on record and it’s not listed in CISA KEV, you should treat this as a serious patch-now item for any affected SharePoint deployment.

1. Confirm what you run

   • Identify whether your environment includes Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition.
   • Record the current SharePoint build/version number(s).

2. Check for exposure

   • Compare your build against the Microsoft fixed versions provided for CVE-2026-64921.
   • Consider a higher priority if SharePoint is reachable from the internet or if you have users/roles that an attacker could plausibly obtain (the vulnerability requires an authorized attacker according to the provided description).

3. Patch to a fixed version (the exact targets)

   • SharePoint Enterprise Server 2016: upgrade/fix to 16.0.5565.1001
   • SharePoint Server 2019: upgrade/fix to 16.0.10417.20198
   • SharePoint Server Subscription Edition (and “sharepoint server”): upgrade/fix to 16.0.19725.20522

4. Validate after patching

   • Verify SharePoint now shows the expected build number.
   • Re-check that critical admin/high-permission accounts have not gained unexpected privileges.

5. Temporary risk-reduction while patching (if you need time)

   • Reduce SharePoint’s exposure to the smallest possible network surface (limit inbound access).
   • Review and tighten access controls and privileged roles (least privilege), since the scenario involves an attacker already having an authorized position.
   • Monitor authentication and permission-related events closely for unusual changes (new admin assignments, permission escalations, or abnormal access patterns). If you see suspicious activity, isolate affected instances and escalate internally.

6. Timing

   • Follow Microsoft’s update guidance from their CVE-2026-64921 update page and apply within your next available maintenance window that supports these upgrades.

CVE-2026-64921 is a CWE-306 elevation of privilege issue in Microsoft SharePoint Server. The weakness is described as missing authentication for a critical function, which can allow an authorized attacker to elevate privileges over the network (i.e., increasing their effective permissions beyond what they should have).

Findings summary relevant to operational risk:

• Confirmed exploitation status: not listed in CISA KEV, and no public exploit code is recorded (no direct proof of widespread exploitation in the provided data).
• Patch availability: Microsoft has released fixed builds for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition (plus a corresponding “sharepoint server” fixed build mapped to the same target).
• Public activity signals: security press has noted attention connected to the Lazarus group and the existence of a patch.

Attack characteristics (from the provided technical description/backstop and stated CVSS vector): network-based (AV:N), low attack complexity (AC:L), low privileges required (PR:L), and no user interaction (UI:N). The practical consequence is unauthorized privilege gain within the SharePoint authorization context, which can lead to confidentiality and integrity impact across SharePoint content and administration capabilities.