CVE-2026-54108 MEDIUM

CVE-2026-54108: Microsoft SharePoint Server Spoofing Vulnerability

Vendor Microsoft
Product Microsoft SharePoint Enterprise Server 2016
Weakness CWE-73
Published July 14, 2026
Last update July 24, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

What the vulnerability does

01Description

External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Key dates

02Disclosure timeline

July 14, 2026 CVE published
July 24, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-12654 Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.120 - Authenticated (Admin+) Arbitrary Directory Creation CVE-2025-10134 Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Deletion CVE-2022-0246 iQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip Slip CVE-2025-0898 Xpro Elementor Addons - Pro <= 1.4.7 - Authenticated (Contributor+) Arbitrary File Read via Draw SVG CVE-2024-7626 WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) <= 1.6.9 - Improper Path Validation to Authenticated (Subscriber+) Arbitrary File Move and Read