CVE-2026-69804: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition in Microsoft Microsoft SharePoint Server Subscription Edition

This vulnerability is a TOCTOU race condition in Microsoft SharePoint Server Subscription Edition that permits an authorized attacker to execute arbitrary code remotely. The flaw arises due to a timing issue between checking a condition and using the result, which can be exploited to escalate privileges or execute code. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges without user interaction. Microsoft has released an official fix for affected versions.

An authorized attacker with low privileges can exploit this vulnerability remotely to execute arbitrary code, potentially leading to full compromise of the affected SharePoint server. The impact includes complete loss of confidentiality, integrity, and availability of the system. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft and should be applied promptly to affected versions. Refer to the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69804 for patch details and deployment instructions.