Summary
Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What type of information could be disclosed by this vulnerability?
An attacker could possibly gain access to an organizational's email, sites, filenames, or the URLs of files.
Security updates
16.0.20326.20082 — https://support.microsoft.com/help/5002908
Vulnerabilities 1
-
Medium 6.5
Microsoft Office SharePoint Information Disclosure Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
Revision history
-
#2
Updated an acknowledgement. This is an informational change only.
-
#1
Information published.
References
-
CVE-2026-69636 Microsoft Office SharePoint Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69636
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss