CVE-2026-80095: Microsoft Office SharePoint Elevation of Privilege Vulnerability

Q: Which SharePoint deployment is identified as affected?

The affected software listed is Microsoft SharePoint Server Subscription Edition.

Q: Can an unauthenticated internet attacker exploit this issue directly?

The supplied vector indicates privileges are required, so the attacker must be an authorized user. Exploitation is network-based and has low attack complexity.

Q: Does exploitation require someone else to take an action?

Yes. The supplied vector specifies that user interaction is required.

Published Nov 10, 2026

Updated

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

Other sources

Microsoft Office SharePoint Elevation of Privilege Vulnerability

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft SharePoint Server Subscription Edition<16.0.20326.20278

16.0.20326.20278

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.20326.20278Patch KB5002945

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·04:00 PM

Affected Software

CVE Published

via MITRE·06:20 PM

Data Sourced

via MITRE·06:20 PM

DescriptionSeverity

Data Sourced

via NVD·07:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which SharePoint deployment is identified as affected?

The affected software listed is Microsoft SharePoint Server Subscription Edition.

Can an unauthenticated internet attacker exploit this issue directly?

The supplied vector indicates privileges are required, so the attacker must be an authorized user. Exploitation is network-based and has low attack complexity.

Does exploitation require someone else to take an action?

Yes. The supplied vector specifies that user interaction is required.

CVE-2026-80095: Microsoft Office SharePoint Elevation of Privilege Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which SharePoint deployment is identified as affected?

Can an unauthenticated internet attacker exploit this issue directly?

Does exploitation require someone else to take an action?

Company

Resources

Contact

Frequently Asked Questions

Which SharePoint deployment is identified as affected?

Can an unauthenticated internet attacker exploit this issue directly?

Does exploitation require someone else to take an action?