Microsoft Office SharePoint introduces code that originates in an untrusted control sphere; an attacker with sufficient authenticated access can execute arbitrary code on the SharePoint server. This leads to full compromise, allowing the attacker to read, modify or delete data, install malware, or pivot to other systems. The weakness is a privilege escalation flaw identified as CWE‑829 and the impact covers confidentiality, integrity, and availability of the affected system.

The vulnerability affects Microsoft SharePoint Server Subscription Edition. No specific version ranges are disclosed, so all installed instances are considered at risk until a vendor update is applied.

The CVSS score of 7.2 indicates moderate to high severity. The EPSS score is not available, so the public exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploits at the time of this writing. An attacker would need network access to the SharePoint server and valid administrative or privileged user credentials; the vulnerability can be exploited by leveraging untrusted input that is executed by the application.