CVE-2026-109454

CriticalCVSS 9.0/10Last modified Nov 10, 2026

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1094556.5Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.CVE-2026-1094564.6Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attCVE-2026-1094578.0Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to exeCVE-2026-1094598.1Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.CVE-2026-109467.5Heap buffer overflow in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UCVE-2026-1094605.5Exposure of sensitive information to an unauthorized actor in Microsoft Entra Private Network Connector allows an authorized attacker to disCVE-2026-1094615.9Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over CVE-2026-1094624.4Improper check for certificate revocation in Azure Firmware allows an authorized attacker to bypass a security feature locally.CVE-2026-1094638.8Deserialization of untrusted data in Windows DNS allows an unauthorized attacker to execute code over a network.CVE-2026-1094648.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-1094668.0Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over an adjacent network.CVE-2026-1094679.9Improper authentication in Azure DevOps allows an authorized attacker to execute code over a network.
CVE-2026-109454: Critical severity, CVSS 9.0 | Vulnix