Quick Look: CVE-2026-109499, Type Confusion Code Execution in SharePoint Server Subscription Edition

Introduction

Microsoft's November 2026 Patch Tuesday release closed a type confusion flaw in SharePoint Server Subscription Edition that lets an authenticated user with Design permission on a single site run code on the SharePoint server itself. For organizations running SharePoint on premises, the distance between a site-level account and code execution on farm servers is one submission of specially crafted content, and no other user needs to click anything.

Microsoft rates the issue CVSS 3.1 8.8 (High), reports that it was neither publicly disclosed nor exploited at release, and ships the fix in cumulative update KB5002945.

Technical information

Root cause

CVE-2026-109499 is classified as CWE-843, access of resource using incompatible type, better known as type confusion. In this class of bug, the server reads an object as one type when it is actually another, and an attacker can steer the operations performed under that wrong assumption. Microsoft's description states that in SharePoint this condition can be reached by an authorized attacker and can lead to code execution over a network.

Microsoft has not published several details that matter to anyone trying to reason about exposure:

• No affected component, request handler, or endpoint has been named.
• No payload format or serialization mechanism has been described.
• SharePoint Server is closed source, so there is no public commit or diff to inspect.

Any more specific claim about the internal code path would go beyond what the vendor has disclosed, so we do not make one here.

CVSS breakdown

The CVE record gives the CVSS 3.1 base vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H:

• Attack vector, Network (AV:N): reachable over the network.
• Attack complexity, Low (AC:L): no special conditions beyond the stated prerequisites.
• Privileges required, Low (PR:L): an authenticated account is needed. Microsoft clarifies this as Design permission on an affected site.
• User interaction, None (UI:N): no action by another user is required.
• Scope, Unchanged (S:U).
• Impact, High across confidentiality, integrity, and availability (C:H/I:H/A:H).

The temporal metrics set exploit maturity to unproven and remediation level to Official Fix.

Attack flow

Based on Microsoft's advisory, exploitation proceeds as follows:

1. The attacker holds, or obtains, an authenticated account with Design permission on a site hosted by a SharePoint Server Subscription Edition farm running a build earlier than 16.0.20326.20278.
2. The attacker submits specially crafted content to the affected site over the network.
3. SharePoint processes that content and accesses a resource using an incompatible type.
4. The type confusion results in code execution on the SharePoint server. No other user has to take any action.

In this scenario, the attacker needs Design permission on one site, not farm administration rights. Reviewing who holds Design permission across your site collections gives a realistic picture of who sits inside the stated precondition.

Exploitation status

At publication, Microsoft marked the vulnerability not publicly disclosed and not exploited, with an assessment of Exploitation Less Likely. The reviewed advisory and CVE material do not name a threat actor, campaign, proof of concept, or observed intrusion tied to this CVE. These are the published statuses at release, not a guarantee about later activity.

Patch information

Microsoft fixed CVE-2026-109499 in the November 10, 2026 release with security update KB5002945 for SharePoint Server Subscription Edition.

• KB article: KB5002945
• Fixed build: 16.0.20326.20278
• Affected range (per CNA/NVD): 16.0.0 up to but not including 16.0.20326.20278
• SHA256: 31B944695F41590F52167E59EC3BF09DEA0590C9546C08D681607CE80E14F0E6
• Replaces: KB5002927 (October 2026)
• Channels: Microsoft Update, Microsoft Update Catalog, Microsoft Download Center

How the fix works, and what we cannot see

There is no public diff, and Microsoft has not said which code path changed. Type confusion bugs are usually fixed by checking an object's real type before the code casts or uses it, rejecting unexpected types, or limiting which types can be built from user-supplied data rather than trusting the type the input claims to be. That is the general pattern for the bug class, not a confirmed description of Microsoft's change.

A cumulative uber package

KB5002945 is a cumulative uber package that fixes 24 CVEs at once. Besides CVE-2026-109499, it covers other SharePoint remote code execution, spoofing, information disclosure, security feature bypass, and elevation of privilege issues, plus Word remote code execution issues. Two consequences follow:

• This fix cannot be installed on its own. Moving to build 16.0.20326.20278 or any later cumulative update brings in the full November set.
• It supersedes the previous update. Because it replaces October's KB5002927, farms jumping directly from older builds still receive every earlier fix.

The package also carries changes unrelated to security, such as a fix for the Search Host Controller service stopping unexpectedly after a restart and new time zone data for Alberta and British Columbia. Plan test cycles with those functional changes in mind.

Prerequisites and side effects

• Release version required: the release version of SharePoint Server Subscription Edition must be installed.
• SharePoint Workflow Manager: if it runs in the farm, install KB5002799 before KB5002945.
• Classic Workflow Manager: to keep using it, add server debug flag 53601. The KB provides this snippet:

$farm = Get-SPFarm
$farm.ServerDebugFlags.Add(53601)
$farm.update()
iisreset

• InfoPath Forms Services: turned off by default since the September 2026 update and only available again via debug flag 5023. Microsoft warns that the July 13, 2027 update will remove SharePoint 2010 workflows and InfoPath Forms Services entirely, so patching past that point removes those features permanently.
• Configuration Wizard: the November cumulative update guidance says to run the SharePoint Products Configuration Wizard on each machine in the farm after installation.

Verifying the fix

A farm is patched when its build is 16.0.20326.20278 or higher. Before installing a manually downloaded package, compare its SHA256 against the value above. Microsoft also publishes a CSV listing every file in KB5002945, which helps when comparing binaries before and after the update. As with any SharePoint cumulative update, remediation is complete only when the update is installed on every server in the farm and the configuration and database upgrade step has finished.

Affected systems and versions

• Product: Microsoft SharePoint Server Subscription Edition
• Platform: x64 systems
• Vulnerable versions: 16.0.0 up to, but not including, 16.0.20326.20278
• Required condition: an attacker account with Design permission on an affected site

The CVE record does not list other SharePoint editions. It does not establish that SharePoint Online, SharePoint Server 2019, or SharePoint Server 2016 is affected by this particular CVE.

Vendor security history

SharePoint on premises has recent history as a target. In 2025, Microsoft documented active exploitation of separate on-premises SharePoint vulnerabilities, including CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771. Microsoft described web shell deployment and machine key theft in that activity and attributed observed exploitation to Linen Typhoon, Violet Typhoon, and Storm-2603.

Those reports concern different CVEs. They show attacker interest in the platform, but they do not establish exploitation of, or actor involvement in, CVE-2026-109499.

References

• MSRC Security Update Guide: CVE-2026-109499
• NVD entry for CVE-2026-109499
• CVE.org record for CVE-2026-109499
• Microsoft Support: KB5002945 security update for SharePoint Server Subscription Edition
• Microsoft Support: KB5002945 description (kb path)
• Stefan Gossner: SharePoint security fixes released with November 2026 PU
• Stefan Gossner: November 2026 CU for SharePoint Server Subscription Edition
• Microsoft Learn: SharePoint updates release notes
• Microsoft Security Blog: Disrupting active exploitation of on premises SharePoint vulnerabilities (2025)
• Microsoft Support: What is SharePoint?
• Microsoft 2026 Annual Report