CVE-2026

Api.Msrc.Microsoft • September 8, 2026

We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. You may change your selection by clicking “Manage Cookies” at the bottom of the page. Privacy Statement Third-Party Cookies

Released: Sep 8, 2026

Please see Common Vulnerability Scoring System for more information on the definition of these metrics.

Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

The following table provides an exploitability assessment for this vulnerability at the time of original publication.

I am running SharePoint Server 2016. Do the updates for SharePoint Enterprise Server 2016 also apply to the version I am running?

Yes. The same KB number applies to both SharePoint Server 2016 and SharePoint Enterprise Server 2016. Customers running either version should install the security update to be protected from this vulnerability.

How could an attacker exploit this vulnerability?

An authenticated attacker with low-level, list-level permissions on a SharePoint site could submit a specially crafted event receiver definition that causes the server to load an attacker-specified code library and construct an attacker-specified type before the server has verified that the caller is authorized to do so. Successful exploitation could allow the attacker to execute code on the SharePoint server. Network access and authentication are required; user interaction is not required.

There are multiple update packages available for some of the affected software. Do I need to install all the updates listed in the Security Updates table for the software?

Yes. Customers should apply all updates offered for the software installed on their systems. If multiple updates apply, they can be installed in any order.

Dongjun Kim (smlijun) with UIUC

Jongseong Kim (nevul37) with UIUC

Hwiwon Lee (hwiwonl) with UIUC

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle .

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Disclosed on September 8, 2026, Affecting Microsoft Products On September 8, 2026, multiple CVEs were disclosed affecting various Microsoft products, including SharePoint and Office. Key vulnerabilities include improper access controls, buffer overflows, and command injections, which could allow unauthorized code execution and information disclosure. CVE-2026-85880, noted for active exploitation, was added to CISA's KEV list on the same day. Other vulnerabilities, such as CVE-2026-69428 and CVE-2026-69621, also pose significant risks due to their potential for exploitation. Organizations using affected versions of Microsoft products are urged to apply patches immediately to mitigate risks. The vulnerabilities impact a range of systems, including SharePoint Server and Microsoft Office, and could lead to severe consequences if exploited. 927 sources 74

Extracted Entities

Platforms (3)

Microsoft Office SharePoint SharePoint Enterprise Server 2016 SharePoint Server 2016