Microsoft SharePoint Server Subscription Edition: Cross-site scripting (spoofing)
Summary
A cross-site scripting (XSS) flaw in on-premises Microsoft SharePoint Server Subscription Edition allows an authorized attacker to inject script into SharePoint web pages and perform spoofing over the network. The attack requires a low-privilege account and user interaction, such as opening a crafted page or link. The CVSS vector rates the impact on confidentiality and integrity as high.
Affected
- Microsoft SharePoint Server Subscription Edition (on-premises), 16.0.0 before 16.0.20326.20278
Fixed in
- Build 16.0.20326.20278 or later (per the CVE record; not yet confirmed on the MSRC page)
- Update: KB 5002945, identical with the November 2026 CU for SharePoint Server Subscription Edition (also offered as November 2026 PU via Microsoft Update)
- If the farm is at the September 2025 CU, correct the folder permissions with the PowerShell script described in the linked article before installing, otherwise the installation fails
Workaround
Unknown. No vendor workaround found in the sources. Patching is the primary control.
Exploitation
- No evidence of exploitation in the wild found for this CVE.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV (per Strix). No public proof of concept found.
Our recommendation
- Identify all on-premises SharePoint Server Subscription Edition farms and verify that the build number is 16.0.20326.20278 or higher.
- Install KB 5002945 after checking the September 2025 CU permission issue.
- Until patched, restrict access to affected sites and monitor for suspicious links and unusual sessions.
- Check the MSRC advisory for the exact KB and build list.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Spoofing – Microsoft Office SharePoint
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Microsoft Office
- Updates (KB)
- KB5002945
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-109504 msrc.microsoft.com
- CVE Record CVE-2026-109504 www.cve.org
- Stefan Gossner: SharePoint security fixes released with November 2026 PU blog.stefan-gossner.com
- Strix: CVE-2026-109504 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:32.
Original description (NVD)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.