Missing Authorization in Microsoft SharePoint Server - CVE-2026-109466
Published: November 10, 2026
Vulnerability identifier: #VU164736
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-109466
CWE-ID: CWE-862
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user on the local network to escalate privileges and gain administrative control of the SharePoint farm's content database server.
The vulnerability exists due to missing authorization checks in Microsoft Office SharePoint when handling actions by users with permission to contribute content to a SharePoint site. A remote user on the local network can exploit these missing checks to gain administrative control of the farm's content database server.
Exploitation requires authentication relaying to be permitted on the adjacent network.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-109466
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20278