External risk intelligence

Microsoft SharePoint Server-Side Request Forgery Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-70332

Microsoft SharePoint is commonly deployed as an internet-facing enterprise portal, collaboration platform, or document management system. Given its role as a centralized web service intended for broad access, the attack surface for this SSRF vulnerability is frequently exposed to the public internet.

Cross-site Scripting

Microsoft Sharepoint Online

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Microsoft Office SharePoint has a vulnerability that could allow an attacker to impersonate users or systems by sending malicious requests over a network. This type of flaw, known as Server-Side Request Forgery, can be serious if exploited, as it may enable unauthorized actions or access to sensitive information. The main concern is confirming if our specific SharePoint deployments are relevant and potentially exposed.

SharePoint flaw lets attackers impersonate others.
Confirm if our SharePoint is affected.
Understand potential exposure and impact.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to a Microsoft Office SharePoint server. This could be achieved without any prior authentication or special privileges, as long as the server is accessible over a network and user interaction is involved. Successful exploitation could lead to spoofing, allowing the attacker to impersonate legitimate network traffic.

No authentication required.
User interaction triggers the vulnerability.
Enables network spoofing.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability allows an unauthorized attacker to perform spoofing over a network. When supported by the advisory, an attacker could trick the server into making unintended network requests, potentially exposing sensitive information or altering service behavior.

Server-side requests could be spoofed.
Attacker crafts special requests to server.
Service may behave unexpectedly or leak data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This Server-Side Request Forgery vulnerability in Microsoft Office SharePoint necessitates action from teams responsible for its operation and security. The initial practical move is to identify all SharePoint instances within the environment, ascertain their network accessibility and business criticality, locate the accountable system owner, and then prioritize remediation based on potential impact and exposure.

Ownership: SharePoint administrators and security teams.
Verification: Confirm instance reachability and business impact.
Action: Plan targeted patching during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Microsoft Office SharePoint?

Microsoft Office SharePoint is a widely used enterprise platform designed for document management, team collaboration, and internal portals. It functions as a central web service where organizations store sensitive files and manage business workflows, making it a critical hub for corporate data and communication.

What does Server-Side Request Forgery mean for CVE-2026-70332?

This vulnerability is classified as CWE-918, or Server-Side Request Forgery (SSRF). In plain terms, it means an attacker can trick the SharePoint server into making web requests on their behalf. By manipulating the server to act as a proxy, the attacker can force it to interact with internal or external systems, potentially allowing them to bypass security controls or spoof legitimate network traffic.

How can an attacker trigger this SharePoint vulnerability?

An attacker triggers this flaw by sending a specially crafted request to the SharePoint server. Crucially, the process requires user interaction to succeed, meaning the server does not automatically process the malicious payload on its own. It is not triggered by simple network background noise; it relies on the specific, manipulated request reaching the application.

Do I need to worry if my SharePoint is internal?

Halo Surface Signal indicates that SharePoint is frequently deployed as an internet-facing portal, which often places it within an attacker's reach. While internal instances face a lower risk of direct external exploitation, you should still care if your configuration allows broad network access. Assess whether your environment exposes the server to untrusted segments, as the vulnerability affects the server's ability to handle network-based requests securely.

When should I start responding to this CVE?

You should begin by locating all SharePoint instances in your infrastructure. Identify the system owners and determine which servers are reachable over the network, prioritizing those that are business-critical or publicly accessible. Once you have a clear inventory, work with your security team to schedule the necessary updates during your next maintenance window.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70332

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.