Technical impact
The flaw is an SQL injection caused by improper neutralization of special elements in SQL commands within Microsoft Office SharePoint. An attacker with authorized credentials can inject malicious SQL statements that the server executes, leading to unauthorized privilege escalation and potentially granting access beyond the attacker's intended scope.
Affected Systems
Affected product is Microsoft SharePoint Server Subscription Edition. Specific vulnerable versions are not listed in the CVE data, so any deployed SharePoint Server Subscription Edition that has not yet received the latest security update should be considered at risk.
Risk and Exploitability
With a CVSS score of 8.8, the vulnerability is considered high severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, indicating no publicly known exploits yet. The likely attack vector requires an attacker to already have authenticated access; thus the exploitation is probably limited to internal or compromised credentials. Nonetheless, the high severity coupled with the potential for privilege escalation makes it a critical issue that should be addressed promptly.
