Technical Information

An unauthenticated attacker can exploit improper verification of cryptographic signatures by modifying a valid proof token belonging to a targeted user and submitting it to a vulnerable SharePoint server, allowing the attacker to impersonate the user and gain unauthorized access to or modify content permitted by the compromised account, provided that specific attack conditions are met.

Patch release date: Oct 13, 2026
Further information on this vulnerability is available at : CVE-2026-102866