---
id: "CVE-2026-111297"
page: "https://infrastack.ai/live/CVE-2026-111297"
kind: "vulnerability"
aliases: ["CVE-2026-111297"]
title: "SharePoint Server Subscription Edition: cross-site scripting lets a signed-in user spoof pages (fixed in Nov 2026 update)"
severity: "high"
cvss: 8.0
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Microsoft SharePoint Server Subscription Edition", "fixed": ["16.0.20326.20278"], "affected": ">= 16.0.0, < 16.0.20326.20278", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["microsoft", "on-premises", "self-hosted", "sharepoint", "vendor", "xss"]
not_affected_if: ["patched-16.0.20326.20278", "sharepoint-online"]
published_at: "2026-11-10T19:18:27+00:00"
first_seen_at: "2026-11-10T19:24:28+00:00"
updated_at: "2026-11-11T00:28:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111297", "first_seen_at": "2026-11-10T19:24:28+00:00"}, {"source": "analyst", "url": "https://blog.stefan-gossner.com/2026/11/10/sharepoint-security-fixes-released-with-november-2026-pu-and-offered-through-microsoft-update/", "first_seen_at": "2026-11-11T00:28:15+00:00", "cites": ["https://blog.stefan-gossner.com/2026/11/10/sharepoint-security-fixes-released-with-november-2026-pu-and-offered-through-microsoft-update/", "https://support.microsoft.com/en-us/servicing/office/hotfix/sharepoint/5002945", "https://app.opencve.io/cve/CVE-2026-111297"]}]
exploit_sources: []
---

# SharePoint Server Subscription Edition: cross-site scripting lets a signed-in user spoof pages (fixed in Nov 2026 update)

Link for people: https://infrastack.ai/live/CVE-2026-111297 (this .md is for agents)

Cross-site scripting (CWE-79) in on-premises SharePoint Server Subscription Edition lets an authenticated attacker spoof content over the network. A victim has to interact (CVSS 3.1 8.0 from Microsoft, UI:R). Microsoft fixed it in KB5002945 on Nov 10, 2026. No exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft SharePoint Server Subscription Edition affected >= 16.0.0, < 16.0.20326.20278 fixed 16.0.20326.20278

## How to check

On SharePoint Server Subscription Edition, check the farm build in Central Administration > Upgrade and Migration > Check product and patch installation status, or run (Get-SPFarm).BuildVersion in the SharePoint Management Shell. A build below 16.0.20326.20278 is missing the fix. Also check SharePoint 2016 and 2019 farms: the sources found do not list them as affected or fixed.

## Fix

Install KB5002945 (November 10, 2026 security update) for SharePoint Server Subscription Edition, build 16.0.20326.20278 or later. It replaces KB5002927 and is cumulative.

## Timeline

- 2026-11-10T19:24:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111297
- 2026-11-11T00:28:15+00:00 analyst https://blog.stefan-gossner.com/2026/11/10/sharepoint-security-fixes-released-with-november-2026-pu-and-offered-through-microsoft-update/ — KB5002945 (Microsoft support page) lists CVE-2026-111297, build 16.0.20326.20278. Affected range from CVE record via OpenCVE, not the MSRC page, which web-cli could not load (JS-only). Fix and how_to_check verified from KB; products left unverified. No exploitation or PoC found; did not search social posts.

## Documents

- [describes] SharePoint security fixes released with November 2026 PU https://blog.stefan-gossner.com/2026/11/10/sharepoint-security-fixes-released-with-november-2026-pu-and-offered-through-microsoft-update/
- [fix] KB5002945: SharePoint Server Subscription Edition security update, November 10, 2026 https://support.microsoft.com/en-us/servicing/office/hotfix/sharepoint/5002945
- [mentions] OpenCVE CVE-2026-111297 (CNA affected range) https://app.opencve.io/cve/CVE-2026-111297

## From the sources

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_