CVE-2026-54108
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
A vulnerability in Microsoft Office SharePoint allows an authorized attacker to control file names or paths, enabling network spoofing. The issue stems from external control over these parameters.
Risk Assessment
The organization is at risk of spoofing attacks that could impersonate trusted sources or manipulate data in SharePoint. This may lead to loss of information integrity and user trust.
Recommendation
Apply the security update provided by Microsoft for Microsoft Office SharePoint immediately. Additionally, restrict user permissions and monitor unusual file-related requests.
Other vulnerabilities in Microsoft Office SharePoint
See all- CVE-2026-40368High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-40357High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-35439High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-33112High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-33110High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-20951High
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
- CVE-2026-20947High
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-70306Critical
A cross-site scripting vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-70332Critical
Improper input neutralization during web page generation (cross-site scripting) in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-55040CriticalActively exploited
A vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over the network due to weak authentication.
Original NVD description (English source)
External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.