Microsoft SharePoint Server: critical flaws (CVE-2026-109454, CVE-2026-120002) fixed in build 16.0.20326.20278
CVE-2026-109454 CVE-2026-120002
Published 11/11/2026 19:52
Timeline
2 events over 1 d 2 h
- 10/11/2026 17:00ConfirmedMicrosoft Security Update Guide+1 d 2 h
- 11/11/2026 19:52Published on WatchtowerPro CISO
In short
Microsoft fixed two critical SharePoint flaws on 10/11/2026: a cross-site scripting (spoofing) flaw (CVE-2026-109454) and an elevation of privilege flaw (CVE-2026-120002). SharePoint Server Subscription Edition builds before 16.0.20326.20278 are affected. Update to that build or later. Microsoft rates exploitation of CVE-2026-109454 as less likely, and neither flaw is on CISA's known-exploited list.
How bad is it
Critical. An attacker with a low-privilege SharePoint account can gain far higher access, including to connected back-end services, or spoof content to other users, over the network.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
The worst of 2 CVEs · CVSS 3.1 from NVD, from microsoft.com, read 11/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginA user account
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Read the data it holds
- Change or delete that data
- Take it offline
Type: privilege escalation.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Microsoft SharePoint Server Subscription Edition (x64), versions from 16.0.0 up to but not including 16.0.20326.20278 (both CVE.org records).
Fixed in
- 16.0 branch: 16.0.20326.20278
What to do now
- Update SharePoint Server Subscription Edition to build 16.0.20326.20278 or later.
- Microsoft's pages as retrieved gave no workaround, so the update is the only vendor-backed fix.
- Limit the exposure of SharePoint to untrusted networks and review who has page-edit rights and Secure Store target application membership. This is general hardening, not vendor advice; such measures reduce exposure and do not make a server safe.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 6 open questions, followed up as sources answer and all 6 sources with their dates. And technology matching: which of your systems run Microsoft Office SharePoint, at which version, fixed or not - and what each one needs.
Main sources
CVE-2026-109454 Microsoft Office SharePoint Spoofing Vulnerability Vendor · CVE-2026-120002 Microsoft SharePoint Server Elevation of Privilege Vulnerability Vendor · NCSC-2026-0474 [1.00] [M/H] Kwetsbaarheden verholpen in Microsoft Office CERT