Microsoft SharePoint Server: Server-side request forgery with information disclosure
Summary
Microsoft SharePoint Server Subscription Edition contains a server-side request forgery (SSRF) vulnerability (CWE-918). An authenticated attacker with a low-privilege account can abuse the server to send requests on their behalf and disclose information over the network. Integrity and availability are not affected.
Affected
- Microsoft SharePoint Server Subscription Edition, builds 16.0.0 up to but not including 16.0.20326.20278
Fixed in
- Build 16.0.20326.20278 (November 2026 CU)
- Security update KB5002945 (reported as identical to the November 2026 CU; verify on the MSRC page)
- Whether older SharePoint versions (2016/2019) are fixed is not confirmed.
Workaround
Unknown.
Exploitation
- No known exploitation as of the NVD record; CISA SSVC: exploitation none, not automatable.
- CISA KEV status not verified directly; a third-party source shows KEV: No.
- No public proof of concept found.
Our recommendation
- Install KB5002945 on SharePoint Server Subscription Edition farms this week, starting with farms reachable from the internet or used by external users.
- Verify the fix and KB mapping on the MSRC advisory before rollout.
- Review accounts with low privileges and external guest or partner access.
- Monitor SharePoint logs for unusual outbound requests from the server.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Information disclosure – Microsoft Office SharePoint
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Microsoft Office
- Updates (KB)
- KB5002945
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-124210 msrc.microsoft.com
- CVE Record CVE-2026-124210 www.cve.org
- Stefan Gossner: November 2026 CU for SharePoint Server Subscription Edition blog.stefan-gossner.com
- Stefan Gossner: SharePoint security fixes released with November 2026 PU blog.stefan-gossner.com
- Ivanti security content 11/10/2026 protectessentials.shavlik.com
- Automox: Patch Tuesday November 2026 www.automox.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:01.
Original description (NVD)
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.