CVE-2026-70332
Analyzed Analyzed - Analysis Complete

Microsoft Office SharePoint Server-Side Request Forgery

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: Microsoft Corporation

Description
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-27
AI Q&A
2026-08-07
EPSS Evaluated
2026-08-26
NVD
CVE-2026-70332

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
microsoft sharepoint_online *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a server-side request forgery (SSRF) vulnerability in Microsoft Office SharePoint. An unauthorized attacker can exploit it to perform spoofing over a network by sending crafted requests from a trusted server.

Detection Guidance

Detection requires monitoring for unusual web requests or scripts in SharePoint. Check SharePoint logs for suspicious input patterns or unexpected script execution. Use tools like Fiddler or browser developer tools to inspect network traffic for malformed requests targeting SharePoint pages.

Impact Analysis

An attacker could use this to access internal systems, steal sensitive data, or perform unauthorized actions on behalf of a trusted user. The high CVSS score indicates significant risk of confidentiality, integrity, and availability compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Apply the latest security updates from Microsoft for SharePoint as soon as possible to patch the vulnerability. Monitor Microsoft's security advisories for patches and follow their recommended mitigation steps.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70332. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart