sharepoint_server: Insufficiently Protected Credentials (CVE-2026-62839)

Description

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

Metrics

Weakness classes (CWE)

• CWE-522Class

  Insufficiently Protected Credentials

  The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

  cwe.mitre.org →

References & sources

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62839
  vendor-advisorypatch

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

1. Initial Analysis2026-08-11 20:50 UTC· nvd@nist.gov
   • CPE Configuration: OR *cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* *cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:* *cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:* versions up to (excluding) 16.0.19725.20522
   • Reference Type: Microsoft Corporation: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62839 Types: Patch, Vendor Advisory
2. New CVE Received2026-08-11 17:18 UTC· secure@microsoft.com
   • Affected: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition
   • Description: Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
   • CVSS V3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
   • CWE: CWE-522

Linked advisories

• ncsc-nl2026-08-27 10:23 UTC
  NCSC-2026-0286 [1.01] [H/H] Kwetsbaarheden verholpen in Microsoft Office
• sans-atrisk-mail2026-08-13 00:00 UTC
  @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 31