CVE-2026-120002 is a critical (CVSS 9.9) incorrect-authorization flaw in Microsoft SharePoint that lets an authenticated attacker elevate privileges over the network.
What Is It
Microsoft describes CVE-2026-120002 as "incorrect authorization in Microsoft Office SharePoint" that "allows an authorized attacker to elevate privileges over a network." The weakness is classified as CWE-863 (Incorrect Authorization). Microsoft published the CVE on 2026-11-10. NVD lists it as "Awaiting Analysis."
Why It Matters
Microsoft scores the flaw 9.9 (CRITICAL) under CVSS 3.1, with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In plain terms:
- Network-reachable and low attack complexity
- Needs only low privileges. The attacker must be authenticated, but a basic account is enough.
- No user interaction is required
- Scope changed: impact can reach beyond the vulnerable component
- High impact to confidentiality, integrity and availability
Exploitation status: The sources cited below do not confirm active exploitation. Even so, any low-privileged account may be enough to cause high impact across confidentiality, integrity and availability, with scope reaching beyond SharePoint itself. Defenders should treat this as a high priority.
What's Vulnerable
The CNA record lists one affected product:
| Vendor | Product | Platform | Affected Versions |
|---|---|---|---|
| Microsoft | SharePoint Server Subscription Edition | x64-based systems | 16.0.0 up to but not including 16.0.20326.20278 |
The record lists no other SharePoint editions as affected, and NVD has not yet published CPE data for this CVE.
Patch Status
The affected-version range ends at 16.0.20326.20278, which means builds at or above that version are not affected. Administrators should update SharePoint Server Subscription Edition to build 16.0.20326.20278 or later and follow Microsoft's guidance in the MSRC Security Update Guide entry below.