Vulnerabilities / CVE-2026-120002
Critical · not yet confirmed exploited · Microsoft SharePoint Server Subscription EditionCVE-2026-120002
Microsoft SharePoint Server Subscription Edition critical privilege escalation, CVSS 9.9.
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
| Vendor and product | Microsoft · Microsoft SharePoint Server Subscription Edition |
|---|---|
| Type | privilege escalation |
| Severity | Critical 9.9 CVSS base score |
| Affected versions | Microsoft SharePoint Server Subscription Edition: 16.0.0 to before 16.0.20326.20278 |
| First published | 10 November 2026 |
| Weakness | CWE-863: Incorrect Authorization |
| Exploited | Not confirmed. Critical flaws in Microsoft products have been exploited before: Microsoft appears on CISA's exploited list. |
| Advisories | msrc.microsoft.com ↗ |
Patch before it is exploited
Install the update on every affected system, servers and workstations alike.
Escalation bugs are chained after a first foothold: check for other exposures an attacker could start from.
Review who holds administrative rights, and alert on new ones.
Know the day it starts being used
Threat Landscape Monitoring fingerprints the software your internet-facing hosts disclose and tells you the day a vulnerability on them is confirmed exploited, with the host and the fix. The free plan covers one domain.
CVE-2026-120002 in short
Is CVE-2026-120002 being exploited?
Not confirmed as of 14 November 2026: CISA has not added it to its Known Exploited Vulnerabilities catalogue. Critical flaws in Microsoft products are a frequent target, so patch before that changes; this page is updated daily.
How severe is CVE-2026-120002?
NVD rates it critical, with a CVSS base score of 9.9.
Which versions of Microsoft SharePoint Server Subscription Edition are affected by CVE-2026-120002?
According to the CVE record: Microsoft SharePoint Server Subscription Edition: 16.0.0 to before 16.0.20326.20278. Check the vendor's advisory for the fixed version.
How do I fix CVE-2026-120002?
Install the update on every affected system, servers and workstations alike. Escalation bugs are chained after a first foothold: check for other exposures an attacker could start from. Review who holds administrative rights, and alert on new ones.
Sources: NVD, the CVE record, FIRST EPSS and the CISA Known Exploited Vulnerabilities catalogue. Page compiled automatically by SAK T.L.M, the threat-intelligence tool of SAK T.E.C, on 14 November 2026.