CVE-2026-109492

HighCVSS 8.8/10Last modified Nov 10, 2026

Description

Authorization bypass through user-controlled key in Microsoft MCP Gateway allows an authorized attacker to elevate privileges over a network.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-639

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1094938.8Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.CVE-2026-1094948.8Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.CVE-2026-1094956.6Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-1094968.8Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.CVE-2026-1094977.3Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attCVE-2026-1094987.5Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.CVE-2026-1094998.8Access of resource using incompatible type ('type confusion') in Microsoft Office SharePoint allows an authorized attacker to execute code oCVE-2026-10956.4The Canto Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fx' shortcode attribute in all versions upCVE-2026-109506.5Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin daCVE-2026-1095007.5Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1095018.8Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1095028.8Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-109492: High severity, CVSS 8.8 | Vulnix