Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office     SharePoint allows an authorized attacker to perform spoofing over a network. (CVE-2026-109454,     CVE-2026-109456, CVE-2026-109497, CVE-2026-109504, CVE-2026-110045, CVE-2026-110065, CVE-2026-111297,     CVE-2026-111300, CVE-2026-111303)

  - Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute     code over a network. (CVE-2026-109464, CVE-2026-109472, CVE-2026-110044, CVE-2026-120000, CVE-2026-123390)

  - Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges     over a network. (CVE-2026-109495, CVE-2026-88176)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Remote Code Execution via integer overflow in Microsoft Office SharePoint (CVE-2026-88166)

  - Elevation of Privilege in SharePoint Server Subscription Edition (CVE-2026-96044)

  - Elevation of privilege via improper cryptographic signature verification (CVE-2026-102866)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
378494	Security Updates for Microsoft SharePoint Server Subscription Edition (November 2026)	Nessus	Windows : Microsoft Bulletins	Local	critical
365628	Security Updates for Microsoft SharePoint Server Subscription Edition (October 2026)	Nessus	Windows : Microsoft Bulletins	Local	high

Detections

Analytics

CVE-2026-88176

high

Tenable Plugins

critical

high