Microsoft · Path traversal
Path Traversal in Microsoft Office SharePoint allows an authorized attacker to execute code over a network
At a glance
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
- Do not treat uncorroborated claims as confirmed breaches.
Questions to ask IT
- Do we run Microsoft Office and Microsoft SharePoint, and which versions?
- Is any of it reachable from the internet?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 23 Nov?
Next steps
- Confirm whether this affects systems or suppliers in your estate
Vulnerability facts
Full CVE detail CVE-2026-108452- 8.8 · HighExploitable over the network with a low-privilege account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Not listed
- ~0.8% estimated chance of attack in 30 days
No technical write-up beyond these facts and the summary below yet.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates.
Read the original reportMicrosoft Security Update Guide RSS(opens in a new tab)
Products and services involved
- Microsoft Office98% match confidence · CVE-2026-108452
- Microsoft SharePoint96% match confidence · CVE-2026-108452
Pulse
Last checked 3 Nov · Recheck overdue since 7 Nov 2026, 07:36 UK time · 1 quiet check collapsed
- Story15 Oct 2026, 22:43 UK time · 15 Oct
Linked reporting from Microsoft Security Update Guide RSS (vendor psirt).
Read source (Microsoft Security Update Guide RSS) - Signal24 Oct 2026, 17:06 UK time · 24 Oct
in the next 30 days first recorded at 0.6% (lower likelihood signal, not confirmed exploitation).
2 entries so far. The timeline chart appears once this story has more history.
Sources
CVE-2026-108452 Microsoft Office SharePoint Remote Code Execution Vulnerability
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorised attacker to execute code over a network
- ProbableSummary fact75% confidence
This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-108452