A public GitHub repo by huynambka claims a CVE-2026-26114 SharePoint RCE PoC with both Python and Metasploit paths. The retained README shows authenticated NTLM inputs, a command or marker-file mode, proxy and insecure options, and optional taxonomy and site IDs when auto-discovery is not used. The source does not show independent validation, affected versions, patch status, or production evidence.