CVE-2026-109455: Microsoft Office SharePoint Information Disclosure Vulnerability

Q: What level of access does an attacker need to exploit this issue?

The attacker must already be authorized, meaning they need valid access to the affected SharePoint environment. Exploitation can be performed over the network and does not require user interaction.

Q: What is the expected impact if the vulnerability is exploited?

Successful exploitation may allow disclosure of information. The available data indicates high confidentiality impact, with no identified integrity or availability impact.

Published Nov 10, 2026

Updated

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

Other sources

Microsoft Office SharePoint Information Disclosure Vulnerability

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft SharePoint Server Subscription Edition<16.0.20326.20278

16.0.20326.20278

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.20326.20278Patch KB5002945

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·04:00 PM

Affected Software

CVE Published

via MITRE·06:15 PM

Data Sourced

via MITRE·06:15 PM

DescriptionSeverity

Data Sourced

via NVD·07:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker must already be authorized, meaning they need valid access to the affected SharePoint environment. Exploitation can be performed over the network and does not require user interaction.

What is the expected impact if the vulnerability is exploited?

Successful exploitation may allow disclosure of information. The available data indicates high confidentiality impact, with no identified integrity or availability impact.

CVE-2026-109455: Microsoft Office SharePoint Information Disclosure Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the expected impact if the vulnerability is exploited?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the expected impact if the vulnerability is exploited?