Overview of CVE-2026-120002: SharePoint Server Secure Store Incorrect Authorization Leading to Elevation of Privilege

Introduction

Many SharePoint farms act as a credential broker for other business systems. They hold shared accounts in Secure Store so users can reach line-of-business data without ever seeing a password. The November 10, 2026 fix for CVE-2026-120002 addresses a flaw in that brokering role. A user who already has site read access and Secure Store target application membership could make SharePoint perform unauthorized actions against a connected business service using the shared credential.

Microsoft assigns a CVSS 3.1 base score of 9.9 (Critical) with a changed scope, while labeling the advisory severity as Important. The score and the severity label are two separate assessments, so they do not contradict each other. At publication, Microsoft reported the issue as not publicly disclosed, not exploited, and Exploitation Less Likely. Secondary coverage from Automox labels it More Likely, but the MSRC advisory is the vendor's official position. Senserva noted it was not in the CISA KEV catalog in its November 10 snapshot. No threat actor, victim, or indicator of compromise has been tied to this CVE.

Technical information

Root cause: incorrect authorization (CWE-863)

Microsoft classifies the weakness as CWE-863, Incorrect Authorization. In this class of bug, the application does run an authorization check, but the check produces the wrong result for the request in front of it. The public CVE description is short ("Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network"). The MSRC FAQ narrows the code path considerably: it involves Secure Store target applications and actions taken on a connected business service using shared credentials.

Why Secure Store membership matters

Secure Store is the SharePoint service that stores encrypted credentials for external systems. A target application maps a user, group, or claim to a set of credentials in that database. In normal operation, Secure Store:

1. Confirms the requesting user is authorized for the target application.
2. Retrieves the mapped credentials.
3. Lets a SharePoint service application use them on the user's behalf, which Microsoft describes as impersonation.

Target applications can use individual mappings (each user has a unique credential) or group mappings (all members share one credential). Microsoft's planning guidance notes group mappings are easier to maintain and can perform better, while individual mappings provide user-specific access logging on the back end. Microsoft also notes that the external data account's rights are granted directly on the data source and are not controlled by SharePoint.

So membership in a target application should not, on its own, authorize every possible operation against the back-end service. SharePoint is expected to enforce what the user may actually do through the brokered credential, and CVE-2026-120002 is a failure of that boundary. The changed scope (S:C) in the vector reflects that the impact lands on the external business service, outside SharePoint's own security authority.

Attack flow

Based on the MSRC FAQ, the documented exploitation model is:

1. The attacker holds an authenticated account on the SharePoint farm with site read access.
2. The same account is a member of the relevant Secure Store target application, for example through a group mapping that shares one credential across many users.
3. The attacker sends a specially crafted network request to an affected SharePoint server.
4. Because the authorization decision on that path is incorrect, SharePoint performs unauthorized actions on the connected business service using the shared credential.
5. No additional user interaction is required.

For scoping, the gaps in the advisory matter too. It does not describe theft or decryption of the Secure Store credential database, unauthenticated access, or server takeover. Microsoft has not published the request endpoint, payload format, the specific faulty check, or which connected service type is involved.

CVSS breakdown

The NVD page shows the Microsoft-supplied vector (NVD itself was Awaiting Enrichment and had not published an independent NIST score):

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

The "Low" privileges rating should not be read as "any user". The Secure Store membership requirement is what makes a given farm exposed in practice. Microsoft's temporal score, with Remediation Level set to Official Fix (RL:O), is 8.6.

Patch information

Microsoft fixed CVE-2026-120002 in its November 10, 2026 Patch Tuesday release through security update KB5002945 for SharePoint Server Subscription Edition. SharePoint is closed source, so there is no public commit or diff. The authoritative artifacts are the MSRC advisory, the KB article, and the fixed build number.

What the update is

• Package: KB5002945, "Description of the security update for SharePoint Server Subscription Edition: November 10, 2026". The KB lists CVE-2026-120002 among resolved advisories as a "Microsoft SharePoint elevation of privilege vulnerability".
• Fixed build: 16.0.20326.20278. The MSRC Security Update Guide shows this build for the Subscription Edition row. Any farm at or above this build has the fix.
• Packaging: this is the monthly cumulative "uber" package. It also fixes more than 20 other SharePoint and Word CVEs from this month (information disclosure, RCE, spoofing, and security feature bypass), and it replaces KB5002927. There is no standalone hotfix for this CVE alone.

File:   uber-subscription-kb5002945-fullfile-x64-glb.exe
SHA256: 31B944695F41590F52167E59EC3BF09DEA0590C9546C08D681607CE80E14F0E6

What the fix likely changes

Microsoft has not published release notes or code describing the change. The most reasonable reading of the FAQ is that build 16.0.20326.20278 adds or corrects the authorization check on the affected request path, so that site read access plus Secure Store membership no longer lets a user act with the shared credential beyond what is intended. This is an inference from the advisory, and Microsoft has not confirmed the implementation details. Microsoft does publish a file manifest (a CSV linked from the KB) listing every replaced binary, which researchers can use to compare builds before and after.

Deploying and verifying

• Sources: Microsoft Update, the Microsoft Update Catalog (search KB5002945), and the Microsoft Download Center (download ID 108898). Where automatic updating is enabled, the update downloads and installs automatically.
• Base prerequisite: the release version of SharePoint Server Subscription Edition must be installed.
• Workflow prerequisites: farms running SharePoint Workflow Manager must install KB5002799 before this cumulative update. Farms on Classic Workflow Manager must add server debug flag 53601 to keep it working.
• Finishing the install: installing binaries is only half the job. Run the SharePoint Products Configuration Wizard (or PSConfig) on each server, then confirm the farm build reports 16.0.20326.20278 or later.
• Regression scope: the package also includes unrelated changes, such as Search Host Controller fixes and time zone updates for Alberta and British Columbia. The KB also documents a known issue where the SharePoint Search Host Controller might stop unexpectedly after being manually stopped and restarted, so review the KB notes when planning maintenance.

Complementary hardening (not a substitute for the fix)

Microsoft's Secure Store documentation offers service-level guidance that is relevant given this flaw's impact, though none of it is a published workaround for CVE-2026-120002:

• The external data access account should be a low-privilege account that only allows data access. Since its rights are enforced at the data source, this directly bounds what any misuse of a shared credential can do.
• Run Secure Store in a separate application pool, and host its credential database on a separate SQL Server location from content databases.
• The Secure Store audit log is disabled by default. It can be enabled through Properties, Enable Audit, Audit log enabled. Microsoft presents it as a troubleshooting aid. It is not a detection rule for this CVE.

Affected systems and versions

Practical exposure requires all of the following:

• A Subscription Edition farm below build 16.0.20326.20278.
• Secure Store configured with at least one target application that brokers credentials to a connected business service.
• An attacker account with site read access that is also a member of that target application.

The impact assessment should cover the connected business service and the permissions granted to its external data account, as well as SharePoint permissions. Microsoft's broader SharePoint product descriptions (Microsoft 365, Copilot integration) do not expand the affected product list for this CVE.

Vendor security history

On-premises SharePoint has drawn serious attacker attention before. Microsoft's July 2025 investigation documented exploitation of CVE-2025-49706 (spoofing) and CVE-2025-49704 (remote code execution) against internet-facing SharePoint servers. Microsoft attributed espionage activity to Linen Typhoon and Violet Typhoon. It also documented Storm-2603 moving from initial access through an exposed SharePoint server to persistence, credential extraction, lateral movement, and Warlock ransomware deployment. Microsoft responded with security updates for Subscription Edition, 2019, and 2016 and recommended immediate installation.

This history is background only and implies no attribution. Those were different vulnerabilities with different mechanics, and none of those actors has been linked to CVE-2026-120002. Microsoft's current advisory reports no exploitation at publication.

References

• NVD: CVE-2026-120002
• CVE Record: CVE-2026-120002
• Microsoft Security Update Guide: CVE-2026-120002
• Microsoft Support: KB5002945 security update for SharePoint Server Subscription Edition
• Microsoft Support: KB5002945 (alternate link)
• Dark Reading: November Patch Tuesday coverage
• Automox: November 2026 Patch Tuesday
• Senserva: CVE-2026-120002 summary
• StackFlag: CVE-2026-120002
• CISA Known Exploited Vulnerabilities feed
• Microsoft Security Blog: Disrupting active exploitation of on premises SharePoint vulnerabilities (July 2025)
• Microsoft Learn: Configure the Secure Store Service in SharePoint Server
• Microsoft Learn: Plan the Secure Store Service in SharePoint Server
• Microsoft Learn: Secure Store for Business Intelligence service applications
• Microsoft SharePoint product overview