CVE-2026-108452: turning SharePoint exposure data into a patch decision

CVE-2026-108452 is a CWE-22 path traversal vulnerability in Microsoft SharePoint Server Subscription Edition on x64 systems. With a CVSS 3.1 score of 8.8, it allows an authorized attacker with low privileges to execute code over the network. Affected versions range from 16.0.0 up to builds below 16.0.20326.20190. Microsoft released the fixed build 16.0.20326.20190 via KB5002927 on October 13, 2026, to address the risk associated with limited SharePoint identity boundaries.