This vulnerability is a server‑side request forgery in Microsoft SharePoint. An attacker with authorized access can cause the server to send HTTP requests to arbitrary destinations within the internal network, effectively allowing them to spoof traffic or interact with adjacent systems. The flaw can be exploited to retrieve sensitive data, manipulate services, or conduct further attacks on internal resources without requiring elevated privileges.

Microsoft SharePoint Server Subscription Edition is impacted. No specific version details were provided in the advisory.

The vulnerability has a CVSS score of 5.7, indicating moderate severity. Its EPSS score is 0.00368, indicating a very low exploitation probability, and it is not listed in the CISA KEV catalog, suggesting a lower likelihood of current exploitation. The likely attack vector requires an attacker to have authorized access to SharePoint and to craft malicious content or exploit a link that causes the server to forward requests to internal targets. Given the moderate score and lack of public exploits, the immediate threat is limited, but organizations should assess the risk relative to their own internal segmentation and access controls.