Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
How could an attacker exploit this vulnerability?
An authenticated attacker with the Design permission on an affected SharePoint site could submit specially crafted content over the network. Successful exploitation could allow the attacker to execute code on the affected SharePoint server. No action by another user is required.
Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
Security updates
16.0.20326.20278 — https://support.microsoft.com/help/5002945
Vulnerabilities 1
-
High 8.8
Microsoft Office SharePoint Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-109499 Microsoft Office SharePoint Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109499
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss