CVE-2026-88200
Microsoft Sharepoint Server ≤ 16.0.20326.20190
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-88200 is a high-severity Privilege Context Switching Error (CWE-270) vulnerability in Microsoft Sharepoint Server. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked in the top 48% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-100180
Vulnerability Data
Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 2 OS baselines
V13.2.2
Mitigating Controls (NIST 800-53 r5) AI
AC-24 mandates that access-control decisions be made and enforced correctly for each request, directly addressing flawed privilege context switches.
AC-3 enforces access authorizations according to policy at every request, structurally preventing incorrect privilege elevation or retention across context switches.
AC-6 requires least-privilege assignments and privilege minimization, reducing the opportunity for erroneous privilege state during context transitions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing least-privilege authorization policies and reviews directly prevents improper privilege changes across contexts.
Integrating secure-development practices catches and eliminates context-switching privilege errors during design and coding.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.15 only requires defining a topic-specific access control policy and requirements (with references to other controls); it does not itself enforce rules or stop a privilege context switching error from being present or exploited
A.5.18 governs the provisioning, review, and revocation of access rights granted to an already-authenticated identity; it has no bearing on whether the product itself correctly manages privilege transitions between contexts as described in CWE-270.
Restricting privileged utilities reduces exposure to context-switch privilege errors.
Privileged-access-rights control directly addresses improper privilege elevation during context switches.
Secure-SDLC practices can catch privilege-handling defects early but do not guarantee runtime correctness.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Ubuntu 22.04 (1 rule)
- V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. blocks CWE-270