Introduction
A user holding only low privileges on a SharePoint Server Subscription Edition farm may be able to execute code on the server by sending crafted input over the network, with no interaction from anyone else. Microsoft fixed this deserialization flaw, tracked as CVE-2026-109472 and scored 8.8 (High), in its November 10, 2026 cumulative update. SharePoint farms commonly hold an organization's documents and intranet sites, so the impact of a server compromise extends well beyond the SharePoint service itself.
Technical information
Root cause
The CVE description classifies the issue as CWE 502, deserialization of untrusted data, and states that an authorized attacker can execute code over a network. In a deserialization flaw of this kind, the server reconstructs objects from serialized input without adequately constraining what that input is allowed to produce, so data an attacker influences ends up driving object creation on the server.
Microsoft is the assigning CNA and published the following CVSS 3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Broken down:
- Attack Vector: Network, so the flaw is reachable remotely.
- Attack Complexity: Low, with no special conditions scored as required.
- Privileges Required: Low. The attacker needs an authenticated, low-privileged account. The record does not describe this as an unauthenticated attack.
- User Interaction: None, so no victim action is needed.
- Scope: Unchanged.
- Confidentiality, Integrity, Availability: High.
NVD shows the Microsoft CNA score of 8.8 High. At the time of the record, NVD's own assessment was still awaiting enrichment, with no NIST score.
What has not been disclosed
Microsoft has not published the specific class, endpoint or serialization binder changed for this CVE. The CVE and NVD material also does not identify the serialized input format, the precise permission level required in a real deployment, or a reproducible attack sequence. We are not inferring any of those details from the generic CWE label or the CVSS vector. The CVE record does not provide a workaround.
The Zero Day Initiative's November 2026 review adds context. It says the SharePoint RCEs patched this month are mainly deserialization bugs that a low-privileged authenticated user can reach with a crafted request and no user interaction. That fits a fix that tightens which types the server will deserialize from attacker-influenced input. ZDI is describing the month's SharePoint RCEs as a group, though, and its review does not confirm what the CVE-2026-109472 code change does.
Attack flow
Based on the CVE description, the CVSS vector and the ZDI characterization, the attack follows this general shape:
- The attacker obtains a low-privileged authenticated session on a SharePoint Server Subscription Edition farm running a build earlier than 16.0.20326.20278.
- The attacker sends a crafted request over the network containing serialized data to a code path that deserializes attacker-influenced input.
- The server deserializes the data without sufficiently restricting the resulting types, and the attacker achieves code execution on the server, with high impact to confidentiality, integrity and availability as scored in the vector.
No user interaction is required at any step. The exact endpoint and payload format are not public.
Exploitation status
The CISA Known Exploited Vulnerabilities catalog version 2026.11.10, released November 10, 2026, does not list CVE-2026-109472. The CVE and NVD records do not name a threat actor or report exploitation in the wild. So the reviewed sources contain no confirmed exploitation report for this specific CVE. That does not prove that exploitation has never occurred.
Patch information
Microsoft fixed CVE-2026-109472 in its November 10, 2026 security update for SharePoint Server Subscription Edition, KB5002945. The KB lists CVE-2026-109472 among the 24 CVEs this update fixes.
Fixed version
NVD's affected product data, supplied by Microsoft as the CNA, marks SharePoint Server Subscription Edition as affected from 16.0.0 up to but not including 16.0.20326.20278. KB5002945 installs exactly that build, so 16.0.20326.20278 is the first fixed build. Stefan Goßner's November 2026 CU announcement gives the same build number for the November 2026 Cumulative Update and notes that it is "also a security update." If your farm reports build 16.0.20326.20278 or later, it has the fix.
How the fix ships
SharePoint SE has no public source code or commit, so there is no diff to review. The fix ships as a single "uber" package containing both the language-independent and language-dependent fixes. Microsoft no longer ships these separately. Details from the KB:
- KB: 5002945
- Build: 16.0.20326.20278
- Package:
uber-subscription-kb5002945-fullfile-x64-glb.exe - SHA256:
31B944695F41590F52167E59EC3BF09DEA0590C9546C08D681607CE80E14F0E6 - Supersedes: KB5002927
- Prerequisite: Release version of SharePoint Server Subscription Edition
Use the SHA256 hash to verify the package before deployment, especially if it comes from a mirror or internal repository. Microsoft also publishes a CSV of every file the update changes, linked from the KB. For a closed-source product this is the closest thing to a change manifest, and it is the natural starting point for anyone diffing patched binaries to locate the changed deserialization path.
Installing the cumulative update
KB5002945 is cumulative. It includes every earlier SharePoint SE fix and replaces KB5002927, so missed monthly updates do not need to be applied first. Microsoft's SharePoint update guidance likewise states that Subscription Edition updates are cumulative.
Running the binary alone does not complete the patch, and the remaining step is often missed. Goßner's post says that after installation you must run the SharePoint Products Configuration Wizard (PSConfig) on every server in the farm, so the database schema and farm configuration match the new binaries. Skipping this can leave servers in a mixed or "upgrade required" state.
Getting the package
- Microsoft Update: installs automatically when automatic updating is enabled.
- Microsoft Update Catalog: search for KB5002945 to get the standalone package.
- Microsoft Download Center: download ID 108898. The language selected in the dropdown does not matter. Every option downloads the same package.
Other changes in the same package
KB5002945 also fixes 23 other SharePoint SE CVEs, covering other RCEs, spoofing, elevation of privilege, information disclosure and security feature bypass issues. It carries changes unrelated to security as well, including a Search Host Controller stability fix and updated Alberta and British Columbia time zone support. The notes also state that blocking of remote event receivers registered without an app identity has moved to the March 2027 update. If you run SharePoint Workflow Manager, the KB says to install KB5002799 on the farm before this cumulative update. Plan test cycles around these changes, even though they are not specific to CVE-2026-109472.
No CVE-specific workaround appears in the reviewed sources, so configuration changes should not be treated as a substitute for installing the update.
Affected systems and versions
- Affected: Microsoft SharePoint Server Subscription Edition, versions 16.0.0 up to but not including 16.0.20326.20278.
- Fixed: build 16.0.20326.20278 and later, delivered by KB5002945.
NVD lists SharePoint Server Subscription Edition as the affected product for this CVE. Although the CVE description refers to "Microsoft Office SharePoint," the reviewed sources do not identify SharePoint in Microsoft 365 or other SharePoint Server versions as affected.
Vendor security history
SharePoint Server has been the target of serious attacks involving other vulnerabilities. Microsoft published customer guidance on active attacks against on-premises SharePoint customers involving CVE-2025-53770 and CVE-2025-53771. CISA separately documented exploitation of the ToolShell chain involving CVE-2025-49706 and CVE-2025-49704, and reported malicious payloads and Warlock ransomware activity in that campaign.
These incidents are useful operational context for how attackers have targeted SharePoint farms, but they concern different CVEs. Their indicators, actors and exploitation claims should not be transferred to CVE-2026-109472 without additional evidence.
References
- NVD: CVE-2026-109472
- CVE Record: CVE-2026-109472
- Microsoft Security Update Guide: CVE-2026-109472
- Microsoft Support: KB5002945
- Stefan Goßner: November 2026 CU for SharePoint Server Subscription Edition
- Zero Day Initiative: The November 2026 Security Update Review
- Microsoft Learn: SharePoint updates
- Senserva: KB5002945 SharePoint Server Subscription Edition (November 2026)
- Senserva: CVE-2026-109472
- CISA Known Exploited Vulnerabilities catalog (JSON feed)
- Microsoft Support: What is SharePoint?
- MSRC: Customer guidance for SharePoint vulnerability CVE-2025-53770
- CISA: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities
