Summary
Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
How could an attacker exploit this vulnerability?
An authenticated attacker with Manage Lists permissions could send a specially crafted SOAP request to an affected SharePoint server that causes the server to connect to an attacker-selected internal or external destination and return the response. On a domain-joined farm, the outbound request may also use the SharePoint server's Windows identity. No additional user interaction is required.
Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
Security updates
16.0.20326.20278 — https://support.microsoft.com/help/5002945
Vulnerabilities 1
-
Medium 6.5
Microsoft Office SharePoint Information Disclosure Vulnerability
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-124210 Microsoft Office SharePoint Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124210
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss