CVE-2026-108452 is a high-severity SharePoint vulnerability with a clear vendor fix and a privilege requirement that changes how teams should assess it. Microsoft describes an authorized attacker who can execute code over the network through a CWE-22 path traversal flaw.
Score and real-world meaning
The vendor CVSS 3.1 score is 8.8. The vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Network access is required, attack complexity is low, low privileges are sufficient, and no user interaction is needed. Confidentiality and integrity are High, while availability is not changed in the vector.
A score does not answer whether a particular farm is exploitable. It describes the reported issue, assuming the attacker can reach the vulnerable behavior. Defenders should ask whether a low-privileged identity can reach the affected SharePoint surface, what the server process can access, and whether a successful compromise would cross a meaningful trust boundary.
Technical boundary
The vendor's description is concise. It names improper pathname limitation and states that the outcome is code execution. It does not disclose the exact request parameters or vulnerable code path. Articles and detection rules should avoid inventing those details. The supported finding is that the path handling does not keep attacker-controlled input within the intended directory scope.
The path traversal classification matters because it points to a containment failure. A file path that is accepted by one layer may be interpreted differently by a later file operation. Without the vendor's exploit details, it is not responsible to claim which SharePoint endpoint or file operation is involved.
Affected systems
Microsoft SharePoint Server Subscription Edition on x64 systems is listed from 16.0.0 through builds below 16.0.20326.20190. KB5002927, dated October 13, 2026, installs the fixed build. Microsoft's workflow prerequisite is KB5002799, and classic Workflow Manager deployments also need the documented debug flag step.
Impact
Code execution on a SharePoint server can expose content, allow integrity changes, or create a path to connected systems. The importance of the affected farm is therefore more useful than a generic severity label. An extranet with partner access, a farm with powerful service accounts, and a small internal collaboration site may carry different operational consequences.
The vendor says the attacker needs authorization, but that requirement does not eliminate the risk. Shared links, guest access, stale accounts, and delegated applications can make a low-privileged boundary easier to cross than the label suggests.
Patch verification
The remediation is KB5002927. Verify the installed build rather than relying only on change records. Check every server in the farm and confirm workflow dependencies. Record exceptions with an owner, an exposure justification, and an end date.
Before the patch is complete, restrict unnecessary access to administrative and authoring interfaces, review delegated identities, and monitor for unexpected file or process activity. These are compensating controls, not substitutes for the update.
Exposure check
ZoomEye returned 163,243 matches for app="Microsoft SharePoint" on November 3, 2026. The CVE-specific query returned 0. Because a product fingerprint does not expose the installed build, the 163,243 result cannot be described as vulnerable systems. It is a candidate population for external asset review.
Bottom line
CVE-2026-108452 is worth urgent patching because it combines network reach, low attack complexity, low privileges, and code execution. The fixed build is available. The most useful next action is not speculation about the missing exploit chain, but a verified farm inventory, a completed update, and an access review for low-privileged identities.
References
- 1.
Microsoft Security Update Guide, CVE-2026-108452
- 2.
Microsoft Support, KB5002927
- 3.
Microsoft Learn, SharePoint updates
- 4.
CVE Program, CVE-2026-108452