---
id: "CVE-2026-109504"
page: "https://infrastack.ai/live/CVE-2026-109504"
kind: "vulnerability"
aliases: ["CVE-2026-109504"]
title: "Microsoft SharePoint Server Subscription Edition: cross-site scripting allows spoofing by an authenticated user"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "SharePoint Server Subscription Edition", "fixed": ["16.0.20326.20278"], "affected": "< 16.0.20326.20278", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["microsoft", "microsoft-office", "on-prem", "self-hosted", "sharepoint", "spoofing", "vendor", "xss"]
not_affected_if: ["auth-required", "managed-hosting", "sharepoint-online", "unknown"]
published_at: "2026-11-10T19:18:20+00:00"
first_seen_at: "2026-11-10T19:24:26+00:00"
updated_at: "2026-11-11T00:41:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109504", "first_seen_at": "2026-11-10T19:24:26+00:00"}, {"source": "analyst", "url": "https://blog.stefan-gossner.com/2026/11/10/sharepoint-security-fixes-released-with-november-2026-pu-and-offered-through-microsoft-update/", "first_seen_at": "2026-11-11T00:41:01+00:00", "cites": ["https://blog.stefan-gossner.com/2026/11/10/sharepoint-security-fixes-released-with-november-2026-pu-and-offered-through-microsoft-update/", "https://app.opencve.io/cve/CVE-2026-109504"]}]
exploit_sources: []
---

# Microsoft SharePoint Server Subscription Edition: cross-site scripting allows spoofing by an authenticated user

Link for people: https://infrastack.ai/live/CVE-2026-109504 (this .md is for agents)

Cross-site scripting in SharePoint Server Subscription Edition (CVSS 7.3, rated Important). An authenticated attacker can spoof content shown to other users, and the victim must interact. Fixed in the November 2026 public update, KB 5002945, build 16.0.20326.20278 or later. No exploitation or public PoC seen.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SharePoint Server Subscription Edition affected < 16.0.20326.20278 fixed 16.0.20326.20278

## How to check

On the SharePoint SE farm, check the build in Central Administration > Upgrade and Migration > Check product and patch installation status, or run (Get-SPFarm).BuildVersion in the SharePoint Management Shell. Builds below 16.0.20326.20278 are affected (per OpenCVE's copy of the CVE record; not yet confirmed on the MSRC page).

## Fix

Install the November 2026 update for SharePoint Server Subscription Edition, KB 5002945, build 16.0.20326.20278, and run the configuration wizard / PSConfig. If the farm is at September 2025 CU, fix the folder permissions first or the install fails (Gossner).

## Timeline

- 2026-11-10T19:24:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109504
- 2026-11-11T00:41:01+00:00 analyst https://blog.stefan-gossner.com/2026/11/10/sharepoint-security-fixes-released-with-november-2026-pu-and-offered-through-microsoft-update/ — MSRC page is JS-only and returned empty, so nothing verified. Affected range from CVE record via OpenCVE; fix KB from Gossner's Nov 2026 PU post (SP SE only, not Office Online Server). SharePoint Online not mentioned in any source.

## Documents

- [describes] SharePoint security fixes released with November 2026 PU https://blog.stefan-gossner.com/2026/11/10/sharepoint-security-fixes-released-with-november-2026-pu-and-offered-through-microsoft-update/
- [mentions] CVE-2026-109504 - OpenCVE https://app.opencve.io/cve/CVE-2026-109504

## From the sources

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_