CVE-2026-70326 is an SSRF in SharePoint with an 8.8 CVSS and a 0.00589 EPSS. The low EPSS will tempt you to deprioritize — don't. Here's why the math works differently for this vulnerability class.
The 'authorized attacker' qualifier creates a false sense of containment. It suggests the attacker already has SharePoint credentials, which in most organizations means the incident is 'already happening.' But SharePoint isn't an isolated collaboration tool — it's the hub where enterprise data, AzureAD identities, external sharing, and third-party integrations converge. An SSRF here doesn't just let an attacker fetch internal URLs; it potentially lets a standard user's session reach Azure metadata endpoints, Microsoft 365 backend services, or internal APIs that the platform trusts but the user's nominal authorization level wouldn't justify. The question isn't what a 'standard user' can do in SharePoint — it's what SharePoint's trusted position in your environment lets that session reach.
Historical pattern matters here. SharePoint vulnerabilities tagged with 'authorized attacker' have a documented track record of being the entry point in multi-stage intrusions that surface in breach forensics six to eighteen months later, not in mass exploitation telemetry. ProxyLogon didn't start with 'authorized attacker' either — it started unauthenticated and pivoted to authenticated contexts. The low EPSS measures mass exploitation probability, which is genuinely low. It does not measure targeted campaign utility, which is what makes this vulnerability dangerous.
What to do: map which SharePoint versions are live in your environment — on-prem 2019/2016/2013, SharePoint Online, or hybrid. Each has fundamentally different authorization models and trust assumptions. Audit whether SharePoint service accounts or application principals have been granted permissions to Azure resources, metadata endpoints, or cross-tenant sharing contexts. Treat any SharePoint user session as a potential pivot vector regardless of nominal privilege level. The vulnerability's CVSS severity is real, and the 'authorized attacker' qualifier describes the threat actor profile, not the blast radius.