---
id: "CVE-2026-110045"
page: "https://infrastack.ai/live/CVE-2026-110045"
kind: "vulnerability"
aliases: ["CVE-2026-110045"]
title: "Microsoft SharePoint: cross-site scripting lets an authorized user spoof pages"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "SharePoint Server Subscription Edition", "fixed": ["16.0.20326.20278"], "affected": ">= 16.0.0, < 16.0.20326.20278", "ecosystem": "vendor"}]
ecosystems: []
tags: ["microsoft-office", "on-premises", "sharepoint", "subscription-edition", "vendor"]
not_affected_if: ["auth-required", "sharepoint-online"]
published_at: "2026-11-10T19:18:21+00:00"
first_seen_at: "2026-11-10T19:24:26+00:00"
updated_at: "2026-11-11T00:38:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110045", "first_seen_at": "2026-11-10T19:24:26+00:00"}, {"source": "analyst", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110045", "first_seen_at": "2026-11-11T00:38:31+00:00", "cites": ["https://www.cve.org/CVERecord?id=CVE-2026-110045", "https://blog.stefan-gossner.com/2026/11/10/sharepoint-security-fixes-released-with-november-2026-pu-and-offered-through-microsoft-update/"]}]
exploit_sources: []
---

# Microsoft SharePoint: cross-site scripting lets an authorized user spoof pages

Link for people: https://infrastack.ai/live/CVE-2026-110045 (this .md is for agents)

Microsoft Office SharePoint does not neutralize input when generating web pages, so an authorized attacker can inject script or content that spoofs what other users see. The attack can be carried out over the network.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SharePoint Server Subscription Edition affected >= 16.0.0, < 16.0.20326.20278 fixed 16.0.20326.20278

## How to check

In Central Administration > Upgrade and Migration > Check product and patch installation status, or run (Get-SPFarm).BuildVersion in SharePoint Management Shell; builds below 16.0.20326.20278 on SharePoint Server Subscription Edition are affected.

## Fix

Install the November 2026 security update KB5002945 for SharePoint Server Subscription Edition (build 16.0.20326.20278 or later). If the farm is at September 2025 CU, run the folder-permission fix script from Gossner's post first or the install fails.

## Timeline

- 2026-11-10T19:24:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110045
- 2026-11-11T00:38:31+00:00 analyst https://www.cve.org/CVERecord?id=CVE-2026-110045 — MSRC page is JS-only and unreadable here; used Microsoft's CVE record (CNA data) plus Gossner's Nov 2026 PU post. Affected: SharePoint Server Subscription Edition < 16.0.20326.20278; fix KB5002945. Not exploited, no PoC. Nothing verified (no MSRC page read). SharePoint 2016/2019 and Online not listed in CNA record.

## Documents

- [advisory] CVE record CVE-2026-110045 (CNA: Microsoft) https://www.cve.org/CVERecord?id=CVE-2026-110045
- [fix] SharePoint security fixes released with November 2026 PU https://blog.stefan-gossner.com/2026/11/10/sharepoint-security-fixes-released-with-november-2026-pu-and-offered-through-microsoft-update/

## From the sources

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_