Is CVE-2026-109455 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109455 being exploited in the wild.

How severe is CVE-2026-109455?

Medium severity, with a CVSS score of 6.5, published 10 November 2026.

Is there a fix for CVE-2026-109455?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-109455 attacked?

It is attacked over the network.

Am I affected by CVE-2026-109455?

Check whether you run Microsoft Office SharePoint. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109455: Microsoft Office SharePoint incorrect authorization disclosure

CVE-2026-109455 · Severity: medium · CVSS 6.5 · Published 2026-11-10

Microsoft Office SharePoint, a collaborative document and content management platform used across enterprises, contains an authorization flaw that allows an authenticated user to access information they should not be permitted to view. An attacker with legitimate credentials could exploit this to expose sensitive organizational data over the network.

Technologies: Microsoft Office SharePoint. Vendors: Microsoft.

Quick answers

Is CVE-2026-109455 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109455 being exploited in the wild.
How severe is CVE-2026-109455?: Medium severity, with a CVSS score of 6.5, published 10 November 2026.
Which products and versions are affected?: Microsoft Office SharePoint.
Is there a fix for CVE-2026-109455?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-109455 attacked?: It is attacked over the network.
Am I affected by CVE-2026-109455?: Check whether you run Microsoft Office SharePoint. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an incorrect authorization vulnerability in SharePoint that permits an authenticated attacker to disclose information over the network. The flaw requires the attacker to already possess valid credentials to the SharePoint system. The impact is limited to information disclosure with no code execution or privilege escalation.

Affected products

Microsoft Office SharePoint

Timeline

2026-11-10: disclosed

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109455

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.