Microsoft SharePoint: critical privilege escalation flaw (CVE-2026-120002)

What happened

Microsoft disclosed CVE-2026-120002 on 10 November 2026. Microsoft describes it as an incorrect authorization flaw in Microsoft Office SharePoint. It allows an authorized attacker to elevate privileges over a network. The vulnerability has a CVSS base score of 9.9, which is rated critical.

The attacker needs a valid account first, but it can be one with low privileges. In SharePoint this group can be large: employees, contractors, and partner or customer accounts on extranet sites.

CISA does not list the vulnerability as exploited, and none of the sources available to us report attacks. Microsoft's description gives no further technical details.

Who is affected

Microsoft's description names Microsoft Office SharePoint. Our source data does not list affected or fixed versions. The source data also files the entry under the product "Microsoft Exchange", which contradicts Microsoft's own description. Check the Microsoft advisory linked below to see which SharePoint and Exchange builds Microsoft lists as affected and which updates fix them.

If you run neither SharePoint nor Exchange on-premises, this vulnerability does not concern your servers. For Microsoft-hosted services such as SharePoint Online, check the advisory to see whether you need to do anything.

What to do now

1. List every server running SharePoint Server, including test and staging farms and servers you manage for customers. Also list Exchange servers until the advisory confirms whether Exchange is affected.
2. Open the Microsoft advisory for CVE-2026-120002 linked below. Note the security update that matches each product and version you run.
3. Back up your configuration. Then install the update on every server in the farm, through Windows Update, WSUS or your patch management tool, or by downloading it from the Microsoft Update Catalog.
4. On SharePoint, finish the installation as Microsoft's documentation describes for your version. This usually means running the SharePoint Products Configuration Wizard or PSConfig on each server in the farm.
5. Check that the sites, search and service applications work after the update.
6. If you cannot update right away, limit who can reach SharePoint. Expose it to the internet only where needed, and remove accounts that are unused or no longer necessary.

How to check whether you are affected

• In Central Administration, under Upgrade and Migration > Check product and patch installation status, check the installed build of each SharePoint server. Compare it with the fixed build listed in the Microsoft advisory.
• In PowerShell, run (Get-SPFarm).BuildVersion in the SharePoint Management Shell to see the farm's build version.
• Review the SharePoint ULS logs and IIS logs for unusual changes to permissions, site collection administrators or farm settings, especially by low-privileged accounts. Sources do not report attacks, so these checks are a precaution.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-120002
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120002