CVE-2026-109499

HighCVSS 8.8/10Last modified Nov 10, 2026

Description

Access of resource using incompatible type ('type confusion') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Microsoft	Microsoft SharePoint Server Subscription Edition	>= 16.0.0, < 16.0.20326.20278

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109499

Timeline

Published: Nov 10, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-10956.4The Canto Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fx' shortcode attribute in all versions up CVE-2026-109506.5Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin da CVE-2026-1095007.5Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1095018.8Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1095028.8Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-1095038.8Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1095047.3Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized att CVE-2026-1095058.8Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1095065.9Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An CVE-2026-109518.8Use after free in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specif CVE-2026-1095126.4The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and incl CVE-2026-1095137.2The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification