CVE-2026-62839

The 'authorized attacker' qualifier in this CVE is doing more work than it first appears — and understanding what it actually means is critical for prioritizing your response. This is not a credential theft vulnerability. The attacker already has valid authentication standing; the vulnerability describes how those credentials or tokens can be improperly captured, replayed, or manipulated to assume a different authorized identity within SharePoint's trust architecture. That's a fundamentally different threat model than breaking in from outside. The CVSS 6.5 with an EPSS of 0.00577 is consistent with a flaw that requires pre-authenticated positioning or specific federation trust conditions — not a mass-exploitable remote entry point. But don't let that low EPSS number create false comfort. The exploitation likely requires knowledge of a particular SharePoint deployment's authentication configuration, which is knowledge an attacker gains only by operating or thoroughly surveying that specific environment. That makes this a high-value target in targeted campaigns rather than an opportunistic scan. The real exposure lives in SharePoint's role as an authentication hub across the Microsoft 365 ecosystem. SharePoint issues claims that downstream systems — Exchange, Teams, Power BI, Azure services — trust without re-verification. A token handling flaw here doesn't compromise a single system; it opens access across the entire M365 trust graph. The 'authorized attacker' qualifier doesn't narrow the blast radius; it means the attacker is already positioned at the most interconnected point in your environment. Your priorities: map which SharePoint authentication pathways are actually in use in your environment — specifically examine claims-based authentication, integrated Windows authentication, SAML federation, OAuth flows, and service-to-service tokens connecting to backend databases and search services. More critically, identify deprecated or legacy authentication endpoints that may still be present in your farm: legacy SAML 1.1 endpoints, classic mode auth stubs, and OAuth flows predating current token binding standards. These forgotten pathways are where the vulnerable credential handling likely lives — not in the actively maintained code paths receiving security scrutiny. Deprecation is not eradication, and patches may target only the pathways administrators actively configure, leaving sibling endpoints in the same deprecated module unpatched. If you're running hybrid configurations, the attack surface expands significantly — federation trust chains between on-premises ADFS and SharePoint Online create additional manipulation vectors. Monitor for unusual token request patterns, especially those originating from legacy endpoints, and audit your authentication configuration for interaction effects between auth modes that could create surprising trust delegations.

Reviewed through automated stages and approved by a human before publication.