Introduction
In SharePoint Server Subscription Edition, a permission that sounds narrow (editing business data connection metadata) was enough to expose authentication information for the farm service account, the most privileged identity in a SharePoint farm. Microsoft patched the issue on November 10, 2026. For organizations that delegate Business Data Connectivity administration to site owners or line-of-business teams, this server-side request forgery flaw turned a limited editing right into a path to farm-level privileges.
CVE-2026-109502 is tracked as CWE-918 and carries the following ratings:
- CVSS 3.1 base score: 8.8 (High).
- Temporal score: 7.7.
- Microsoft severity: Important, with an elevation of privilege impact.
- Exploitation status: Not publicly disclosed and not exploited at release, with exploitation assessed as Less Likely.
Technical information
Root cause
The CVE record describes the issue this way: server-side request forgery in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. Microsoft's advisory FAQ adds two specifics:
- Prerequisite: The attacker must be authenticated and hold permission to edit business data connection metadata, meaning Business Data Connectivity (BDC) and external content type definitions.
- Outcome: A specially crafted request exposes authentication information for the privileged SharePoint farm service account.
The patch notes explain the mechanism further. The server trusted a user-controlled connection definition and sent an outbound request with the farm account's credentials attached. The attacker controls where SharePoint sends a request, and SharePoint authenticates that request as the farm identity.
This is the classic SSRF trust failure. The server acts on a destination supplied by a lower-privileged principal, using its own, much stronger identity. The KB5002945 update hardens how SharePoint handles requests driven by that metadata, so a low-privileged metadata editor can no longer get the farm identity to authenticate to a destination they choose.
SharePoint is closed source. Microsoft has published no diff, no vulnerable code, and no details of the crafted request. We are not reproducing or inferring code here.
Severity vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Reading the vector:
- AV:N, AC:L: The flaw is reachable over the network with low attack complexity.
- PR:L: Only low privileges are required, specifically the metadata editing right described above.
- UI:N: No interaction from another user is needed.
- S:U: Scope is unchanged.
- C:H, I:H, A:H: Impact is High across confidentiality, integrity, and availability, which reflects the broad control the farm service account has over the farm.
- E:U, RL:O, RC:C: Exploit code maturity is unproven, an official fix exists, and the report is confirmed.
The 8.8 CVSS score and Microsoft's Important label are separate assessments. Both stand, and they do not contradict each other.
Attack flow
Based on the advisory and patch notes, exploitation follows this sequence:
- The attacker holds an authenticated SharePoint account with permission to edit business data connection metadata.
- The attacker sends a specially crafted request over the network. The request involves a connection definition under their control.
- SharePoint processes the request and issues an outbound request with the farm service account's credentials attached, directed to a destination the attacker chose.
- Authentication information for the farm service account is exposed to the attacker, moving them from a low-privileged metadata editor to the privilege level of the farm identity.
Microsoft does not describe how the exposed authentication information would be used after step 4, and no further post-exploitation chain is documented. We are not speculating beyond the advisory.
Patch information
Microsoft fixed CVE-2026-109502 on November 10, 2026 (Patch Tuesday) with the security update for SharePoint Server Subscription Edition, KB5002945. The MSRC advisory marks the Remediation Level as Official Fix, which it describes as a complete vendor solution. The NVD record uses the same data Microsoft supplied as CNA.
Patch at a glance:
- Fixed product: Microsoft SharePoint Server Subscription Edition
- Update: KB5002945 (security update, released November 10, 2026)
- Fixed build: 16.0.20326.20278
- Vulnerable range (CNA data on NVD): 16.0.0 up to, but not including, 16.0.20326.20278
- Supersedes: KB5002927
- SHA256 of the full-file x64 package:
31B944695F41590F52167E59EC3BF09DEA0590C9546C08D681607CE80E14F0E6
The MSRC Security Updates table has a single row for this CVE: SharePoint Server Subscription Edition, KB5002945, build 16.0.20326.20278.
Delivery notes
- Cumulative and bundled: KB5002945 is one package that lists 24 CVEs, including CVE-2026-109502. It also carries non-security fixes, such as a Search Host Controller stability fix and time zone updates for Alberta and British Columbia. You cannot install the SSRF fix on its own.
- Where to get it: Microsoft Update (automatic), the Microsoft Update Catalog (search for KB5002945), or the Microsoft Download Center (download ID 108898).
- Requirement: The release version of SharePoint Server Subscription Edition must already be installed.
- Workflow Manager: If the farm runs SharePoint Workflow Manager, install KB5002799 on the farm before this update. Farms using the classic Workflow Manager must add debug flag 53601 to keep it working:
$farm = Get-SPFarm $farm.ServerDebugFlags.Add(53601) $farm.update() iisreset
Verifying the fix
A server is protected once its farm build is 16.0.20326.20278 or later. Use these steps:
- Install the binaries on every server in the farm.
- Complete the upgrade step with the SharePoint Products Configuration Wizard or PSConfig, so the farm reports the new build.
- Confirm the build number in Central Administration, or with PowerShell:
(Get-SPFarm).BuildVersion
- To confirm the correct installer was deployed, compare its SHA256 hash against the value listed above.
The advisory does not document a CVE-specific workaround. Applying the update is the supported remediation.
Affected systems and versions
- Product: Microsoft SharePoint Server Subscription Edition for x64-based systems
- Vulnerable versions: 16.0.0 up to, but not including, 16.0.20326.20278
- Fixed version: 16.0.20326.20278 (KB5002945)
- Vulnerable configuration: Any farm where an authenticated user holds permission to edit business data connection metadata
The CVE record and the MSRC update table list only SharePoint Server Subscription Edition. The available sources do not establish that other SharePoint products or editions are affected.
Vendor security history
On-premises SharePoint was the target of active exploitation in 2025 through vulnerabilities unrelated to this one:
- CISA analysis: CISA examined exploitation involving CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771, including chains that combined vulnerabilities.
- Microsoft reporting: Microsoft reported Storm-2603 activity associated with attempts to steal MachineKeys through on-premises SharePoint vulnerabilities. Microsoft assessed, with moderate confidence, that the actor was China based.
On-premises SharePoint farms have been targeted before, but none of the reporting connects those incidents or actors to CVE-2026-109502. For this CVE, Microsoft's own status remains: not exploited, not publicly disclosed, and exploitation Less Likely.
References
- NVD: CVE-2026-109502
- CVE Record: CVE-2026-109502
- Microsoft Security Update Guide: CVE-2026-109502
- Microsoft Support: Security update for SharePoint Server Subscription Edition (KB5002945)
- Microsoft Support: KB5002945
- Microsoft Download Center: KB5002945
- Stefan Gossner: SharePoint security fixes released with November 2026 PU
- CERT EU: Critical Vulnerabilities in Microsoft SharePoint
- CISA: Exploitation of SharePoint Vulnerabilities (MAR 251132.c1.v1)
- Microsoft Security Blog: Disrupting active exploitation of on premises SharePoint vulnerabilities
- Microsoft Tech Community: A new day for SharePoint Server
- Microsoft Learn: New and improved features in SharePoint Server Subscription Edition
- Microsoft 2025 Annual Report
