An SQL injection flaw exists in Microsoft Office SharePoint: special elements used in an SQL command are not properly neutralized, allowing an authorized attacker to inject malicious SQL statements that can lead to remote code execution. This is identified as CWE‑89. Because the flaw involves code injection into the database layer, successful exploitation would allow the attacker to execute arbitrary code and gain control over the SharePoint server.

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition are affected. No specific build numbers are provided, so any installation of these products that has not applied the latest patch is at risk.

The vulnerability has a CVSS score of 8.8, indicating high severity. The EPSS score is less than 1%, showing that the likelihood of exploitation is currently low, and it is not currently listed in CISA’s KEV catalog. The attack would occur over the network against a SharePoint instance for which the attacker already has authorized access. Once exploited, an attacker could compromise confidentiality, integrity, and availability of the affected system.