This vulnerability involves external control of file name or path in Microsoft Office SharePoint Enterprise Server 2016 (version 16.0.0). It allows an authorized attacker to perform spoofing attacks over a network by manipulating file names or paths. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact. Microsoft has published an official fix for this vulnerability.

An authorized attacker can exploit this vulnerability to spoof network communications by controlling file names or paths, potentially leading to unauthorized disclosure of information. The confidentiality impact is high, but integrity and availability are not affected. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users of Microsoft SharePoint Enterprise Server 2016 version 16.0.0 should apply the vendor-provided patch as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54108 to remediate this vulnerability.