Microsoft SharePoint Server: Elevation of privilege via missing authorization
Summary
Missing authorization in Microsoft SharePoint Server Subscription Edition allows an authenticated attacker with low privileges to elevate their privileges. The attacker needs network access adjacent to the server, such as from the local network or a VPN. Successful exploitation could affect confidentiality, integrity and availability of the server, including stored documents and service accounts.
Affected
- Microsoft SharePoint Server Subscription Edition 16.0.0 before 16.0.20326.20278
- SharePoint Online and Microsoft 365 are not affected according to secondary research.
Fixed in
- Build 16.0.20326.20278 or later (November 2026 SharePoint public update, Subscription Edition).
- Secondary source: the fix is identical to the November 2026 CU, KB 5002945. KB not yet verified against MSRC.
Workaround
- No vendor workaround documented. Status: unknown until the MSRC advisory is checked.
- Interim measure: restrict accounts with site membership or authenticated access and limit access from untrusted network segments until patched.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No evidence of exploitation in the wild found; not verified in the CISA KEV catalogue.
- No public proof-of-concept found; CVSS temporal exploit code maturity is unproven.
- Other on-premises SharePoint flaws were actively exploited in July 2026, so the product is an attractive target.
Our recommendation
- Patch SharePoint Server Subscription Edition with the November 2026 update as a priority.
- Before patching, check farms on the September 2025 CU for the required folder permission script, otherwise the install may fail.
- Verify the build is at least 16.0.20326.20278.
- Review internet exposure of the SharePoint farm and limit site membership and account privileges.
- Monitor for unusual privilege changes and access to SharePoint content.
- Re-check NVD, which was still awaiting analysis at the time of writing.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Microsoft Office SharePoint
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Microsoft Office
- Updates (KB)
- KB5002945
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-109466 msrc.microsoft.com
- CVE Record: CVE-2026-109466 www.cve.org
- Stefan Gossner: SharePoint security fixes November 2026 blog.stefan-gossner.com
- Strix: CVE-2026-109466 www.strix.ai
- Resecurity: July 2026 SharePoint attacks www.resecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:57.
Original description (NVD)
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over an adjacent network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.