Microsoft SharePoint Server Subscription Edition: Remote Code Execution
Summary
A type confusion vulnerability in Microsoft Office SharePoint allows an authorized attacker to execute code over the network. The CVSS vector requires only low privileges and no user interaction, and the impact on confidentiality, integrity and availability is high. According to the CVE record, SharePoint Server Subscription Edition from 16.0.0 before 16.0.20326.20278 is affected, so on-premises SharePoint farms are relevant.
Affected
- Microsoft SharePoint Server Subscription Edition: 16.0.0 to before 16.0.20326.20278
- SharePoint 2016 and 2019: Unknown (not listed in the CVE record)
Fixed in
- Subscription Edition: build 16.0.20326.20278 or later
- Patch reportedly KB 5002945 (third-party source, not yet verified against the vendor advisory)
Workaround
Unknown. No vendor workaround found; apply the security update.
Exploitation
- No public proof-of-concept or in-the-wild exploitation known at time of writing.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- NVD status: Awaiting Analysis.
Our recommendation
- Patch on-premises SharePoint Server Subscription Edition farms to build 16.0.20326.20278 or later with priority.
- Check whether any SharePoint farm is internet-facing and restrict access; where exposure is required, use a reverse proxy or similar application-layer control.
- Review accounts with SharePoint access and remove unused ones, since a low-privileged account is sufficient.
- Plan migration for SharePoint 2016 and 2019, which are out of support and not covered by this fix.
- Monitor for exploitation reports and verify the KB number and details on the MSRC advisory.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Microsoft Office SharePoint
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Microsoft Office
- Updates (KB)
- KB5002945
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-109499 msrc.microsoft.com
- CVE Record CVE-2026-109499 www.cve.org
- Strix: CVE-2026-109499 www.strix.ai
- Stefan Gossner blog: SharePoint security fixes November 2026 blog.stefan-gossner.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:55.
Original description (NVD)
Access of resource using incompatible type ('type confusion') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.