{"id":"CVE-2026-62839","aliases":[],"cve":{"records":[{"id":"CVE-2026-62839","source":"microsoft","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-14T21:10:38.083Z","published":"2026-08-11T17:07:18.702Z","modified":"2026-10-30T17:23:07.897Z"}],"publishers":[{"name":"microsoft","role":"CNA","organizationId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","modified":"2026-10-30T17:23:07.897Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-08-13T13:45:12.429Z"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62839","tags":["vendor-advisory","patch"],"source":"microsoft"}],"weaknesses":[{"id":"CWE-522","description":"CWE-522: Insufficiently Protected Credentials","source":"microsoft"}],"applicability":[{"source":"microsoft","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sharepoint_server_2016:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.0.5565.1001"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sharepoint_server_2019:*:*:*:*:*:*:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.0.10417.20198"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.0.19725.20522"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-08-13T13:44:59.342338Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Microsoft SharePoint Server Spoofing Vulnerability","titleSource":"microsoft","descriptionSource":"microsoft","description":"Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.","score":6.5,"severity":"medium","published":"2026-08-11T17:07:18.702Z","modified":"2026-10-30T17:23:07.897Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Microsoft","name":"Microsoft SharePoint Enterprise Server 2016","platforms":["x64-based Systems"],"versions":[{"version":"16.0.0","status":"affected","lessThan":"16.0.5565.1001","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-62839"},{"vendor":"Microsoft","name":"Microsoft SharePoint Server 2019","platforms":["x64-based Systems"],"versions":[{"version":"16.0.0","status":"affected","lessThan":"16.0.10417.20198","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-62839"},{"vendor":"Microsoft","name":"Microsoft SharePoint Server Subscription Edition","platforms":["x64-based Systems"],"versions":[{"version":"16.0.0","status":"affected","lessThan":"16.0.19725.20522","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-62839"}],"remediation":[],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62839"],"sources":[{"name":"CVE","id":"CVE-2026-62839","modified":"2026-10-30T17:23:07.897Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-62839"}],"assessments":[{"source":"microsoft","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","score":6.5}],"sourceAffected":[],"observedAt":"2026-10-30T18:43:58.493Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T11:50:31.946Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T01:10:33.423Z","attemptedAt":"2026-10-29T01:10:33.423Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-29T01:10:32.507Z","attemptedAt":"2026-10-29T01:10:32.507Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T01:10:32.507Z","attemptedAt":"2026-10-29T01:10:32.507Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-29T01:10:32.507Z","attemptedAt":"2026-10-29T01:10:32.507Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-62839","url":"https://www.first.org/epss/","probability":0.00911,"percentile":0.5989,"date":"2026-10-28","checkedAt":"2026-10-29T01:10:32.507Z"},{"source":"ENISA EUVD","id":"EUVD-2026-56776","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56776","modified":"Oct 28, 2026, 8:08:47 PM","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","checkedAt":"2026-10-29T01:10:32.507Z"},{"source":"GitHub Advisory Database","id":"GHSA-59w3-vwvr-9367","url":"https://github.com/advisories/GHSA-59w3-vwvr-9367","modified":"2026-08-11T18:31:34Z","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-10-29T01:10:32.507Z"},{"source":"NVD","id":"CVE-2026-62839","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62839","modified":"2026-08-13T14:17:03.850","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-10-29T01:10:33.423Z"}],"aiSummary":{"text":"Microsoft SharePoint Server has a spoofing vulnerability due to insufficiently protected credentials, affecting versions less than 16.0.5565.1001, 16.0.10417.20198, and 16.0.19725.20522 of Enterprise Server 2016, Server 2019, and Server Subscription Edition respectively. An authorized attacker can perform spoofing over a network. The weakness is insufficiently protected credentials.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:01:42.673Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-62839"}]}}