Microsoft disclosed CVE-2026-108452, an 8.8 path traversal RCE in SharePoint Server Subscription Edition before 16.0.20326.20190. KB5002927 fixes it; an authenticated Site Owner can exploit it over the network.
Correction (Oct 15): An earlier version said SharePoint Server Subscription Edition versions through 16.0.20326.20190 were affected. The CVE record lists versions before 16.0.20326.20190; that build is the fix shipped in KB5002927.
The vulnerability stems from improper limitation of a pathname to a restricted directory.
The flaw permits remote code execution by an authenticated user.
Administrators should prioritize the KB5002927 update on all SharePoint Server Subscription Edition instances to block authenticated remote code execution.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
Microsoft disclosed CVE-2026-109468, a 7.5 ASP.NET Core denial-of-service flaw affecting Visual Studio 2022 before 17.14.42, Visual Studio 2026 before 18.10.4, and System.Formats.Cbor before 10.0.13.
Microsoft's October security release lists 10 Visual Studio Code vulnerabilities, all rated Important, led by a 9.6 remote code execution bug. None are exploited or publicly disclosed. Users should update to VS Code 1.141.1.
Renovate before 44.79.0 and five Mend Renovate products have a high-severity SSRF flaw, CVE-2026-110868, that can expose cloud credentials. VulnCheck rates it 8.5 under CVSS 3.1.
CISA has included CVE-2026-21589 in its known exploited list, covering eight Atlassian Data Center products with a short compliance window.
Juniper has patched CVE-2026-102023, a flaw in Junos OS Evolved that lets an attacker knock a device's firewall statistics process over with an SNMP request when a firewall counter is set up. Juniper, the CVE numbering authority, scores it 7.5 under CVSS 3.1 and 8.7 under CVSS 4.0.
