CVE-2026-109466: Microsoft Office SharePoint Elevation of Privilege Vulnerability

Q: Who can exploit this vulnerability?

An attacker must already be authorized and able to reach the affected SharePoint Server Subscription Edition instance over an adjacent network. No user interaction is required.

Q: What is the potential impact of successful exploitation?

A successful attacker can elevate privileges. The supplied metrics indicate high potential impact to confidentiality, integrity, and availability.

Q: Is exploit code publicly available?

The provided exploitability information is marked as unknown, so public exploit availability cannot be determined from the available data.

Published Nov 10, 2026

Updated

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Other sources

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over an adjacent network.

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft SharePoint Server Subscription Edition<16.0.20326.20278

16.0.20326.20278

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.20326.20278Patch KB5002945

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·06:15 PM

Data Sourced

via MITRE·06:15 PM

DescriptionSeverity

Data Sourced

via NVD·07:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker must already be authorized and able to reach the affected SharePoint Server Subscription Edition instance over an adjacent network. No user interaction is required.

What is the potential impact of successful exploitation?

A successful attacker can elevate privileges. The supplied metrics indicate high potential impact to confidentiality, integrity, and availability.

Is exploit code publicly available?

The provided exploitability information is marked as unknown, so public exploit availability cannot be determined from the available data.

CVE-2026-109466: Microsoft Office SharePoint Elevation of Privilege Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What is the potential impact of successful exploitation?

Is exploit code publicly available?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What is the potential impact of successful exploitation?

Is exploit code publicly available?