SharePoint CVE-2026-69465: when a signed-in user has too much access

Being allowed to edit a SharePoint page should not give an account the ability to run arbitrary code on the server. CVE-2026-69465 concerns missing authorization that can cross that line. The September update also comes with deployment requirements that administrators need to check against their own farms.

What Microsoft disclosed

Microsoft classifies CVE-2026-69465 as missing authorization that can permit remote code execution by an authenticated attacker. Its September release data associates the issue with SharePoint Server Subscription Edition, rates it Important and records a CVSS 3.1 base score of 8.8. At our check, Microsoft marked exploitation as not observed. That status is time-specific and does not make a reachable affected server safe to leave unpatched.

Microsoft’s CVE-2026-69465 record

Microsoft’s September release data, including affected products

Sign-in is the beginning of the permission check

Authentication identifies the account making a request. Authorization decides whether it may perform this operation on this object. If that second check is missing, hiding the operation in the normal interface does not help: the server still needs to enforce the permission.

MITRE’s definition of missing authorization, CWE-862

For a content platform, page-editing permission must stay separate from authority over server-side execution. Microsoft’s classification identifies an authorization failure affecting that separation. It does not provide the vulnerable request or enough implementation detail to reconstruct the defect.

The authenticated prerequisite matters when assessing exposure. Consider lower-privilege users as well as stolen credentials; a sign-in requirement does not prove that every operation behind it is properly authorized. Keep the product scope precise too. This on-premises SharePoint finding does not establish the same vulnerability in SharePoint Online.

Check the Workflow Manager prerequisite

Microsoft’s September 8 KB5002908 applies to SharePoint Server Subscription Edition and identifies package build 16.0.20326.20124. Its notes require a specific Workflow Manager update, KB5002799, first when SharePoint Workflow Manager is in use. The same bulletin describes changes to legacy features, including workflow and ToolPane behavior. Read the complete prerequisites and known behavior changes against the farm’s actual configuration.

Microsoft’s KB5002908 package and prerequisite notes

Keep the package identity alongside the build number. Different editions and components can use different build values, so one number cannot serve as a universal minimum for every related product. Use Microsoft’s mapping between the CVE, affected edition and applicable package.

Finish the upgrade across the farm

Microsoft’s farm-update documentation distinguishes installation from configuration and database upgrade work. Depending on the supported method, the SharePoint Products Configuration Wizard or PSConfig completes the upgrade phase. Microsoft also calls for verification of upgrade logs and completion across participating servers. Use the documented procedure for the farm topology, including its availability implications.

Microsoft’s SharePoint Server software-update procedure

Before closing the work, confirm the applicable package on every farm server, successful configuration and database upgrades, and the outcome of a representative workflow test. Record exceptions. Have the business owner check document access, search and essential approvals with normal accounts. Any suspicious activity from before the update still needs its own investigation.

If a legacy workflow breaks, check Microsoft’s compatibility guidance before restoring old behavior. Identify the feature the business actually needs. Granting broad permissions or reversing security defaults across the board can leave the original workflow problem unresolved while introducing another access-control problem.

Source check: September 8, 2026. This article analyzes Microsoft’s public records and product documentation; it does not report an original Short Circuit LLC vulnerability finding.