CVE-2026-120002: Microsoft SharePoint Server Elevation of Privilege Vulnerability

Q: What level of access does an attacker need to exploit this issue?

The attacker must already be authorized to access the affected Microsoft SharePoint Server Subscription Edition instance. Exploitation can be performed over the network and does not require user interaction.

Q: What is the potential impact if exploitation succeeds?

A successful attacker can elevate privileges. The provided severity data indicates potential high impact to confidentiality, integrity, and availability, including impact beyond the initially affected security authority.

Published Nov 10, 2026

Updated

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

Other sources

Microsoft SharePoint Server Elevation of Privilege Vulnerability

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft SharePoint Server Subscription Edition<16.0.20326.20278

16.0.20326.20278

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.20326.20278Patch KB5002945

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·06:25 PM

Data Sourced

via MITRE·06:25 PM

DescriptionSeverity

Data Sourced

via NVD·07:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker must already be authorized to access the affected Microsoft SharePoint Server Subscription Edition instance. Exploitation can be performed over the network and does not require user interaction.

What is the potential impact if exploitation succeeds?

A successful attacker can elevate privileges. The provided severity data indicates potential high impact to confidentiality, integrity, and availability, including impact beyond the initially affected security authority.

CVE-2026-120002: Microsoft SharePoint Server Elevation of Privilege Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?