Vulnerability in Microsoft SharePoint Server Subscription Edition

[ Description ]Official description

Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

[ Fixes ]Fixes and patches

• Security bulletin: Microsoft CVE-2026-109461Vendor patch or bulletin · CERT-FR · msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461, cited by CERT-FR CERTFR-2026-AVI-1332
• Security bulletin: Microsoft CVE-2026-109468Vendor patch or bulletin · CERT-FR · msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109468, cited by CERT-FR CERTFR-2026-AVI-1332
• Security bulletin: Microsoft CVE-2026-108452Vendor patch or bulletin · CERT-FR · msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108452, cited by CERT-FR CERTFR-2026-AVI-1332
• Security bulletin: Microsoft CVE-2026-80092Vendor patch or bulletin · CERT-FR · msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80092, cited by CERT-FR CERTFR-2026-AVI-1332

[ Advisories ]Government CERT advisories

• CERT-FR16 Oct 2026CERTFR-2026-AVI-1332

  Multiple vulnerabilities in Microsoft products Translated from French

  Multiple vulnerabilities have been discovered in Microsoft products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-109461CVE-2026-80092CVE-2026-108452+1 more CVEs
• BSI CERT-Bund13 Oct 2026WID-SEC-2026-3916

  Microsoft Office products: Multiple vulnerabilities allow privilege escalation Translated from German

  CVE-2026-108433CVE-2026-97743CVE-2026-97011+209 more CVEs

[ References ]References

• msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108452Vendor Advisory