Brief Summary: SharePoint Server CVE-2026-109464 Deserialization Remote Code Execution

Introduction

Microsoft's November 2026 SharePoint update closes a deserialization flaw that lets an authenticated user with low privileges run code on a SharePoint Server Subscription Edition farm over the network, with no user interaction required. On-premises SharePoint servers hold an organization's documents and collaboration data, and SharePoint was the target of a major exploitation campaign in 2025. That makes this a fix worth scheduling promptly, even though Microsoft has not seen it exploited.

Microsoft rated CVE-2026-109464 Important, with a CVSS 3.1 base score of 8.8 and a temporal score of 7.7. At publication on November 10, 2026, Microsoft stated the issue was not publicly disclosed and not exploited, and assessed exploitation as less likely. The CISA Known Exploited Vulnerabilities catalog page we reviewed did not list it, and we found no threat actor attribution. A Singapore Cyber Security Agency alert does report active exploitation of other SharePoint bugs (CVE-2026-55040 and CVE-2026-63520), but it does not name this CVE, so it should not be read as evidence of exploitation here.

Technical information

Root cause

The weakness is classified as CWE-502, deserialization of untrusted data. Microsoft's advisory confirms only two substantive points. The flaw is a deserialization of untrusted data issue in SharePoint, and an authenticated attacker with low privileges could send a specially crafted request to run code on the server, with no user interaction needed.

In a deserialization bug of this class, the server reconstructs objects from data that an attacker controls. If the deserializer is permitted to instantiate arbitrary types, crafted input can trigger code paths that lead to code execution in the context of the server process.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• AV:N: exploitable over the network
• AC:L: low attack complexity
• PR:L: requires low privileges (an existing authorized account)
• UI:N: no interaction from another user
• S:U: impact stays within the same security authority
• C:H / I:H / A:H: high confidentiality, integrity, and availability impact
• E:U / RL:O / RC:C: exploit code maturity unproven, official fix available, report confirmed

The score shown on NVD is the Microsoft CNA score. NVD marks the record as awaiting enrichment and has not published its own assessment.

What has not been disclosed

SharePoint is closed source, so there is no public commit, diff, or list of changed methods. Microsoft has not identified the affected endpoint, request format, serializer, payload, or exploit chain, and the CWE classification alone does not support inferring any of those details.

As general background only: fixes for deserialization bugs in .NET applications like SharePoint typically either restrict which types the deserializer may create (an allow list or a binder check), or stop passing attacker-supplied data into a deserialization call at all. Microsoft has not confirmed which approach KB5002945 takes, and no code-level explanation should be treated as authoritative until someone publishes a diff of the patched binaries. The KB does link a file manifest (5002945.csv) that researchers can use to identify which assemblies changed between this build and the update it supersedes.

Attack flow, as disclosed

Based strictly on the advisory and CVSS vector, exploitation looks like this:

1. The attacker holds a low-privileged, authorized account on the target SharePoint farm.
2. The attacker reaches the SharePoint server over the network.
3. The attacker sends a specially crafted request carrying data that SharePoint deserializes without adequate restriction.
4. Deserialization results in code execution on the server, with high impact to confidentiality, integrity, and availability.

No further specifics about the request or payload are public.

Patch information

Microsoft fixed CVE-2026-109464 in the November 10, 2026 security update for SharePoint Server Subscription Edition, KB5002945. The MSRC advisory lists the Remediation Level as Official Fix and states that a complete vendor solution is available. The RL:O value in the temporal vector reflects this, bringing the 8.8 base score to a temporal score of 7.7.

Fix details

• Update: KB5002945, the cumulative security update for SharePoint Server Subscription Edition
• Release date: November 10, 2026
• Fixed build: 16.0.20326.20278
• Vulnerable range (CNA data on NVD): 16.0.0 up to, but not including, 16.0.20326.20278
• Supersedes: earlier security update 5002927
• Installer SHA256:

31B944695F41590F52167E59EC3BF09DEA0590C9546C08D681607CE80E14F0E6

The build number is the clearest way to tell whether a server is fixed: any farm at or above 16.0.20326.20278 has the patch. MSRC lists a single affected product row, SharePoint Server Subscription Edition, with KB5002945 as its update.

Delivery

KB5002945 is a cumulative "uber" package, not a single CVE hotfix. Its KB article lists CVE-2026-109464 among roughly two dozen CVEs fixed in the same release, including other SharePoint remote code execution, spoofing, information disclosure, security feature bypass, and elevation of privilege bugs, plus a Word RCE. You cannot install the fix for this deserialization bug on its own. You get it by moving the farm to the November 2026 build. The package is available through:

• Microsoft Update, which installs it automatically if automatic updates are enabled
• Microsoft Update Catalog, as a standalone package
• Microsoft Download Center, download ID 108898

Prerequisites and deployment notes

• The update installs only on top of the release version of SharePoint Server Subscription Edition.
• Farms running SharePoint Workflow Manager must install KB5002799 first.
• Farms using the Classic Workflow Manager must add debug flag 53601 to keep it working.
• Stefan Goßner's release post advises running the SharePoint Products Configuration Wizard on each machine in the farm after installing the fix. This is secondary guidance, so confirm it against Microsoft documentation for your farm.
• A separate Goßner post notes that farms still at the September 2025 CU level must run a folder permission fix script referenced in that post, or installation of the November fixes will fail. This applies only to farms in that specific state.
• When the source material was gathered, Microsoft's SharePoint updates page on Microsoft Learn had not yet added a November entry, so verify the KB-to-build mapping against live Microsoft documentation during change approval.

The advisory does not provide a workaround or interim mitigation, and we found no source-based reason to recommend a network block or configuration change as a substitute for the update.

Unrelated changes in the same package

KB5002945 also includes non-security changes that matter for regression testing:

• A fix for the Search Host Controller service stopping unexpectedly after a manual restart
• Time zone updates for Alberta and British Columbia
• A notice that blocking of remote event receivers registered without an app identity has moved to the March 2027 update

None of these is described as part of the CVE-2026-109464 fix.

Affected systems and versions

• Product: Microsoft SharePoint Server Subscription Edition
• Affected versions: 16.0.0 up to, but not including, 16.0.20326.20278
• Fixed version: 16.0.20326.20278 (KB5002945)
• Configuration requirement for exploitation: the attacker needs low-privileged authorized access and network reachability to the farm

MSRC lists only SharePoint Server Subscription Edition as affected for this CVE.

Vendor security history

SharePoint has a recent history of being targeted. In July 2025, Microsoft published an account of active exploitation of on-premises SharePoint servers through CVE-2025-49706, CVE-2025-49704, CVE-2025-53770, and CVE-2025-53771. Microsoft attributed that activity to Linen Typhoon and Violet Typhoon, as well as Storm-2603, which it reported using the vulnerabilities to deploy ransomware.

In 2026, the Cyber Security Agency of Singapore issued an alert on active exploitation of CVE-2026-55040 and CVE-2026-63520 in SharePoint, without naming threat actors or victim sectors.

These incidents show that SharePoint servers attract attacker attention, but none of them is evidence that CVE-2026-109464 itself has been exploited.

References

• Microsoft Security Update Guide: CVE-2026-109464
• NVD: CVE-2026-109464
• Microsoft Support: KB5002945
• SharePoint updates: Office release notes, Microsoft Learn
• Senserva: KB5002945, SharePoint Server Subscription Edition (November 2026)
• Stefan Goßner: SharePoint security fixes released with November 2026 PU and offered through Microsoft Update
• Stefan Goßner: November 2026 CU for SharePoint Server Subscription Edition is available for download
• Microsoft Security Blog: Disrupting active exploitation of on premises SharePoint vulnerabilities
• CISA Known Exploited Vulnerabilities Catalog
• Cyber Security Agency of Singapore: Active Exploitation of Vulnerabilities in Microsoft SharePoint
• Microsoft 2026 Annual Report