---
id: "CVE-2026-109502"
page: "https://infrastack.ai/live/CVE-2026-109502"
kind: "vulnerability"
aliases: ["CVE-2026-109502"]
title: "Microsoft SharePoint Server: SSRF lets a signed-in user elevate privileges (CVE-2026-109502)"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Microsoft Office SharePoint", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Microsoft SharePoint Server Subscription Edition", "fixed": ["16.0.20326.20278"], "affected": ">= 16.0.0, < 16.0.20326.20278", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["microsoft", "microsoft-office", "other", "self-hosted", "sharepoint", "windows"]
not_affected_if: ["managed-hosting", "sharepoint-online", "unknown"]
published_at: "2026-11-10T19:18:19+00:00"
first_seen_at: "2026-11-10T19:24:26+00:00"
updated_at: "2026-11-11T00:40:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109502", "first_seen_at": "2026-11-10T19:24:26+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109502", "first_seen_at": "2026-11-11T00:40:47+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-109502"]}]
exploit_sources: []
---

# Microsoft SharePoint Server: SSRF lets a signed-in user elevate privileges (CVE-2026-109502)

Link for people: https://infrastack.ai/live/CVE-2026-109502 (this .md is for agents)

SSRF in SharePoint Server Subscription Edition lets an authenticated user with low privileges make the server send requests and elevate privileges over the network. Microsoft rates it CVSS 8.8.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Office SharePoint affected range not listed fixed no fixed version listed
- vendor:Microsoft SharePoint Server Subscription Edition affected >= 16.0.0, < 16.0.20326.20278 fixed 16.0.20326.20278

## How to check

In SharePoint Central Administration > Upgrade and Migration > Check product and patch installation status, or run (Get-SPFarm).BuildVersion in the SharePoint Management Shell; builds below 16.0.20326.20278 are affected.

## Fix

Update SharePoint Server Subscription Edition to build 16.0.20326.20278 or later (per NVD CNA data; confirm the KB on the MSRC page).

## Timeline

- 2026-11-10T19:24:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109502
- 2026-11-11T00:40:47+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-109502 — MSRC page is JS-only and returned nothing; used NVD record carrying Microsoft CNA data (CVSS 8.8, CWE-918, SharePoint Server Subscription Edition < 16.0.20326.20278). Not verified against MSRC; no exploitation or PoC seen.

## Documents

- [describes] NVD CVE-2026-109502 (CNA data from Microsoft) https://nvd.nist.gov/vuln/detail/CVE-2026-109502

## From the sources

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_