SB20261110356 - Multiple vulnerabilities in Microsoft SharePoint Server
Published: November 10, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 13 vulnerabilities.
1) Cross-site scripting (CVE-ID: CVE-2026-109454)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary script in another user's security context, spoof content, and potentially access or modify that user's SharePoint data.
The vulnerability exists due to improper neutralization of input during web page generation in Microsoft Office SharePoint when rendering user-supplied page content. A remote user can store malicious script on a page they have permission to add or modify to execute script in another user's security context when that user views and interacts with the affected content.
The Preview Pane is not an attack vector for this vulnerability.
2) Incorrect authorization (CVE-ID: CVE-2026-109455)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information indexed from SharePoint content outside the sites they are authorized to read.
The vulnerability exists due to incorrect authorization in Microsoft SharePoint Server search functionality when handling requests for indexed content. A remote user can query the affected search index to retrieve information from sites they are not authorized to read.
The disclosure does not provide unrestricted access to every file on the server.
3) Cross-site scripting (CVE-ID: CVE-2026-109456)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to spoof web content and potentially access or modify information within a victim's browser session.
The vulnerability exists due to improper neutralization of input during web page generation in Microsoft Office SharePoint when rendering user-supplied content. A remote user can inject malicious script into web content and induce a victim to interact with it to spoof content and potentially access or modify information within the affected site's context.
4) Deserialization of Untrusted Data (CVE-ID: CVE-2026-109464)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the affected SharePoint server.
The vulnerability exists due to deserialization of untrusted data in Microsoft SharePoint Server when processing specially crafted requests. A remote user can send a specially crafted request to execute arbitrary code on the server.
5) Missing Authorization (CVE-ID: CVE-2026-109466)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user on the local network to escalate privileges and gain administrative control of the SharePoint farm's content database server.
The vulnerability exists due to missing authorization checks in Microsoft Office SharePoint when handling actions by users with permission to contribute content to a SharePoint site. A remote user on the local network can exploit these missing checks to gain administrative control of the farm's content database server.
Exploitation requires authentication relaying to be permitted on the adjacent network.
6) Deserialization of Untrusted Data (CVE-ID: CVE-2026-109472)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the affected SharePoint server.
The vulnerability exists due to deserialization of untrusted data in Microsoft SharePoint Server when processing specially crafted network requests. A remote user can send a specially crafted request to execute arbitrary code on the server.
7) Missing Authorization (CVE-ID: CVE-2026-109495)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to escalate privileges.
The vulnerability exists due to missing authorization in Microsoft Office SharePoint when handling network requests. A remote privileged user can submit requests that exploit missing authorization checks to escalate privileges.
8) Cross-site scripting (CVE-ID: CVE-2026-109497)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to spoof web content, disclose sensitive information, and perform unauthorized actions in a victim's browser context.
The vulnerability exists due to improper neutralization of input during web page generation in Microsoft SharePoint Server when rendering user-supplied content. A remote user can inject malicious script into web content to execute it in a victim's browser following user interaction, enabling content spoofing, access to sensitive information, and unauthorized actions in the affected application.
The Preview Pane is not an attack vector for this vulnerability.
9) Type Confusion (CVE-ID: CVE-2026-109499)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the affected SharePoint server.
The vulnerability exists due to type confusion in Microsoft SharePoint Server when processing specially crafted content submitted over the network. A remote user can submit such content to a SharePoint site on which they have the Design permission to execute arbitrary code on the affected server.
10) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-109502)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges to those of the SharePoint farm service account.
The vulnerability exists due to server-side request forgery in Microsoft SharePoint Server when handling requests from users with permission to edit business data connection metadata. A remote user can send a specially crafted request to expose authentication information for the privileged SharePoint farm service account and potentially act with that account's privileges.
11) Cross-site scripting (CVE-ID: CVE-2026-109504)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to spoof web content and access or modify sensitive information in a victim's browser.
The vulnerability exists due to improper neutralization of input during web page generation in Microsoft SharePoint Server when rendering user-supplied content. A remote user can supply crafted content and induce a victim to interact with it to execute arbitrary script in the context of the affected site.
The Preview Pane is not an attack vector.
12) Deserialization of Untrusted Data (CVE-ID: CVE-2026-110044)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the affected SharePoint server.
The vulnerability exists due to deserialization of untrusted data in Microsoft SharePoint Server when processing network requests from users with Site Member permissions on an affected site. A remote user can send a specially crafted request to execute arbitrary code on the server.
13) Cross-site scripting (CVE-ID: CVE-2026-110045)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to spoof web content, disclose sensitive information, and modify information accessible to a victim.
The vulnerability exists due to improper neutralization of input during web page generation in Microsoft Office SharePoint when rendering user-supplied content. A remote user can submit specially crafted input to execute script in a victim's browser when the victim interacts with the malicious content, enabling content spoofing and unauthorized access to or modification of information.
The Preview Pane is not an attack vector for this vulnerability.
Remediation
Install update from vendor's website.
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-109454
- https://support.microsoft.com/help/5002945
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-109455
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-109456
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-109464
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-109466
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-109472
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-109495
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-109497
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-109499
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-109502
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-109504
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-110044
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-110045