The vulnerability arises from improper control of code generation in Microsoft Office SharePoint, allowing an authorized attacker to inject and execute code with elevated privileges. This code injection flaw (CWE‑94) can bypass normal security checks, enabling the attacker to gain higher‑level permissions to access confidential data, modify content, or conduct further attacks.

Microsoft SharePoint Server Subscription Edition. No version ranges are listed, so all deployed instances of this product should be screened for the vulnerability until a patch is applied.

The CVSS score of 8.8 indicates a high severity level, while the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely network‑based and requires an authenticated attacker who can interact with SharePoint to trigger code generation. Although publicly available exploits have not been disclosed, the potential for privilege escalation warrants rapid remediation.