CVE-2026-69683 is a medium severity flaw in Microsoft Office SharePoint, scored 6.5 by the record. Per the NVD record, it allows an authorized attacker to disclose information over a network. The record does not state a fixed build, so use the Microsoft advisory for the update that applies to your version and apply it.
What's affected
The NVD record lists these affected products: SharePoint Server.
The record describes the issue this way: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
The record gives a CVSS 3.1 base score of 6.5 (MEDIUM), published 2026-09-08, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vector reads as follows. Access is over the network, attack complexity is low, and privileges required are low. No user interaction is needed. Scope is unchanged. Confidentiality, integrity and availability impact are high, none and none.
Microsoft publishes fixed builds on its Security Update Guide, and that page needs a browser to render, so we could not read it automatically. Take version details from there. Where Microsoft's advisory differs from this record on severity or versions, trust the advisory and note the difference in your own tracking.
How to check if you're exposed
On a SharePoint Server farm, read the build number and compare it to the fixed build in the advisory.
Add-PSSnapin Microsoft.SharePoint.PowerShell
(Get-SPFarm).BuildVersion
Also check that every server in the farm reports the same build after patching. A farm with mixed builds can leave one node exposed.
What to do now
- Read the Microsoft advisory and find the SharePoint Server update for your version.
- Patch every server in the farm and run the configuration wizard if the update notes call for it.
- Review which SharePoint accounts can create or edit content that triggers server requests.
- Confirm the farm build version and keep the result.
Why it matters
CWE-918 (server-side request forgery) describes a weakness where a service can be steered into making requests on the caller's behalf, reaching systems the caller could not reach directly.
SharePoint sits close to internal services and identities. A server that can be asked to fetch things on a user's behalf is a useful stepping stone, which is why request forgery bugs deserve attention even when the record scores confidentiality alone.
The record's kev field is false, so the record does not list this CVE in CISA's Known Exploited Vulnerabilities catalog, and no fetched advisory said it was exploited. That is a snapshot, not a promise, so keep watching.
Safeguard's Gold page for this CVE tracks the record, and the free in-browser scan can check dependency manifests for related issues. Reachability analysis helps with libraries, though it does not apply to operating system patches.
Quick check
Does this CVE appear in the CISA Known Exploited Vulnerabilities list?
The record's kev field is false, so it is not listed in CISA's catalog as of the record we hold. That can change, so check the catalog if you are prioritizing.
Can SSRF reach internal systems?
That is what the weakness class allows in general. The record only says the result is information disclosure with high confidentiality impact. Read the advisory for specifics.
Sources
- Microsoft Security Update Guide entry for CVE-2026-69683 (the page did not return readable advisory text to our automated fetch, so confirm details there)
- NVD record for CVE-2026-69683 as supplied in the Safeguard batch data
Last reviewed: 18 October 2026.
