The vulnerability is a server‑side request forgery (SSRF) that lets an attacker with authorized access to a SharePoint site send HTTP requests from the server to arbitrary destinations. Because the request originates from the trusted SharePoint environment, the attacker can reach internal or external services that normally would not be reachable, potentially allowing them to modify configuration or access privileged endpoints. This reflects a CWE‑918 weakness, which can lead to unauthorized privilege escalation within the network.

Microsoft SharePoint Server Subscription Edition is impacted. No specific firmware or application version was supplied, so any deployment of this product is potentially vulnerable until a patch is applied. Administrators should verify the exact SharePoint release and consult Microsoft guidance for updates.

The CVSS score of 7.5 indicates a high severity risk. An EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has yet been reported. Based on the description, it is inferred that the attacker must have valid credentials against SharePoint and can craft malicious outbound requests to internal resources, thereby elevating their privileges or accessing sensitive data.