Microsoft has fixed a SharePoint Server flaw, CVE-2026-120002, scored 9.9 out of 10, that lets a logged-in attacker gain elevated privileges over a network. The elevation of privilege flaw, caused by incorrect authorisation in SharePoint, was patched on 10 November 2026 as part of Microsoft's November Patch Tuesday.

An authenticated attacker could exploit the flaw to gain privileges they should not hold, which in a SharePoint deployment can mean access to sites, documents and settings reserved for administrators. Microsoft rates the flaw as important rather than critical, because an attacker needs a valid account first, but the near-maximum score reflects how much damage a successful attack could do. Microsoft has assessed exploitation as less likely, and the flaw was not marked as exploited when the patch shipped.

What SharePoint admins should do

SharePoint administrators should apply the November SharePoint Server security updates as soon as possible and review which accounts hold elevated rights on their sites. SharePoint was among the most-patched products in this month's release, with 27 SharePoint flaws fixed. Any account with low-level access should hold only the permissions it genuinely needs, so that a flaw like this one buys an attacker as little as possible.

The November release fixed 1,093 flaws in total, with 63 rated critical. Only one flaw in the whole release, the Outlook spoofing bug CVE-2026-124194, was marked as actively exploited. Tenable and BleepingComputer both list CVE-2026-120002 among the notable November fixes.