huynambka/cve-2026-26114-poc

This repository is a proof of concept for CVE-2026-26114, a remote code execution vulnerability in SharePoint. The README states plainly that it is meant to be used only in a lab environment or on systems the user has explicit permission to test, which is the standard disclaimer for security research tools of this kind. The repo provides two ways to run the exploit. The first is a Python script that connects to a target SharePoint server using NTLM authentication, given a username, password, and domain, and then runs a command on the server, for example asking it to run whoami and write the output to a file. It supports routing traffic through a local proxy for inspection and can skip certificate verification, and instead of running a command it can be pointed at writing a marker file to confirm the vulnerability without doing anything more invasive. The second option is a Metasploit module, placed at a specific path under modules/exploits/windows/http, which can be loaded into the Metasploit framework. The README shows the options a user would set, including the target host, port, credentials, domain, and the listener host and port used to receive a reverse connection back from the exploited server. It also notes that if the module's automatic discovery of certain SharePoint internal identifiers does not work, those identifiers can be set manually. There is no license file mentioned, and the README does not include any background on how the vulnerability works internally, only how to run the two provided exploitation methods against a target.