CVE-2026-109504: high-severity vulnerability in Microsoft SharePoint Server Subscription Edition
Microsoft Office SharePoint Spoofing Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
18Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.3
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
Affected products
Microsoft · Microsoft SharePoint Server Subscription EditionRelated CVEs — Microsoft SharePoint Server Subscription Edition
In the same product, most dangerous first.
CVE-2025-53770CRITICALMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 100.0%KEVCVE-2025-49706MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 99.1%KEVCVE-2023-24955HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 85.0%KEVCVE-2026-45659HIGHMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 80.2%KEVCVE-2026-55040CRITICALMicrosoft SharePoint Server Security Feature Bypass VulnerabilityEPSS 69.5%KEVCVE-2024-38094HIGHMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 50.9%KEV