Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office     SharePoint allows an authorized attacker to perform spoofing over a network. (CVE-2026-109454,     CVE-2026-109456, CVE-2026-109497, CVE-2026-109504, CVE-2026-110045, CVE-2026-110065, CVE-2026-111297,     CVE-2026-111300, CVE-2026-111303)

  - Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute     code over a network. (CVE-2026-109464, CVE-2026-109472, CVE-2026-110044, CVE-2026-120000, CVE-2026-123390)

  - Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges     over a network. (CVE-2026-109495, CVE-2026-88176)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over     a network. (CVE-2026-69268, CVE-2026-69273, CVE-2026-69282)

  - Execution with unnecessary privileges in Microsoft Office SharePoint allows an authorized attacker to     elevate privileges over a network. (CVE-2026-69464)

  - Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a     network. (CVE-2026-69465, CVE-2026-69724)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
378494	Security Updates for Microsoft SharePoint Server Subscription Edition (November 2026)	Nessus	Windows : Microsoft Bulletins	Local	critical
343865	Security Updates for Microsoft SharePoint Server Subscription Edition (September 2026)	Nessus	Windows : Microsoft Bulletins	Local	high

Detections

Analytics

CVE-2026-123390

high

Tenable Plugins

critical

high