SharePoint flaw CVE-2026-120002 lets an authorised attacker elevate privileges over a network
Microsoft's update guide names one affected product, SharePoint Server Subscription Edition, and fixes the flaw in build 16.0.20326.20278 with update KB5002945.
Affects
Microsoft Office SharePoint
What to do
Apply Microsoft's update KB5002945 to every SharePoint Server Subscription Edition server, then audit SharePoint permissions.
- NVD published
- CVE
- CVE-2026-120002
- CVSS
- 9.9 (v3.1, Microsoft)
- Exploitation
- None known
- Affected
- Microsoft SharePoint Server Subscription Edition before build 16.0.20326.20278
- Fixed in
- Microsoft SharePoint Server Subscription Edition build 16.0.20326.20278 (update KB5002945)
How the flaw works
The flaw is an incorrect authorisation check in Microsoft Office SharePoint, classed as CWE-863. An attacker who already holds an account SharePoint accepts can raise their privileges over the network.
Microsoft's update guide says the attacker needs read access to a site and membership of the relevant Secure Store target application. A crafted request then makes SharePoint act on a connected business service with shared credentials.
What to do now
Internet-facing SharePoint servers go first, because they take sign-ins from anywhere and the attack needs no administrator rights.
- List every SharePoint Server Subscription Edition server with its build. Any build below 16.0.20326.20278 needs update KB5002945.
- Install the update on every SharePoint server, internet-facing farms first, then confirm the build.
- Where an internet-facing farm cannot take the update within 48 hours, remove its internet exposure until it can.
- Remove stale guest accounts and departed contractors from SharePoint sites.
- Review the members of each Secure Store target application and remove accounts that no longer need it.
- Reset passwords and sessions for accounts with unusual recent sign-ins.
Who is affected
Organisations that run their own SharePoint Server Subscription Edition servers, most of all farms that use Secure Store to reach other business systems. Check each server's build against 16.0.20326.20278, the fixed build in Microsoft's update guide. Firms keeping client files, trust account ledgers or patient letters in SharePoint have most to lose from an attacker holding higher privileges.
Detection notes
Microsoft's update guide lists the flaw as not publicly disclosed and not exploited. Review SharePoint permission settings and audit logs as far back as retention allows.
- Accounts added to site owner or farm administrator groups without a change request
- Broken permission inheritance on libraries holding client or financial files
- Guest or low-privilege accounts opening sites they have never used before
- New site collection administrators nobody on the team appointed
Essential Eight mapping
Patch applications: the Essential Eight Maturity Model sets 48 hours for internet-facing services when the vendor rates a vulnerability critical or a working exploit exists, and two weeks otherwise. Microsoft rates this flaw Important, with exploitation less likely, so the two-week clock applies. Its score is the reason to patch internet-facing farms sooner.
Restrict administrative privileges caps what an elevated account reaches, and multi-factor authentication guards the account the attacker needs.
Sources
- PrimaryNVD, CVE-2026-120002 (published 11 November 2026)Retrieved 11 Nov 2026
- PrimaryMicrosoft Security Update Guide, CVE-2026-120002 (released 10 November 2026)Retrieved 12 Nov 2026
- PrimaryASD, Essential Eight Maturity ModelRetrieved 12 Nov 2026
