# Microsoft Patches 180+ Office Flaws Including SharePoint RCE

Published: 2026-11-10 · Severity: routine
Canonical: https://vorant.io/reports/9ef0a97b-d9c2-5968-b02d-84983a6890ab/microsoft-patches-180-office-flaws-including-sharepoint-rce
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> NCSC-NL advisory covers 180+ Microsoft Office vulnerabilities, including two critical SharePoint flaws (CVSS 9.0 and 9.9) with no confirmed active exploitation.

Source: advisories.ncsc.nl — https://advisories.ncsc.nl/2026/ncsc-2026-0474.html

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

NCSC-NL has published a consolidated advisory for November 2026 covering a very large batch of vulnerabilities patched by Microsoft across the Office product family, including Word, Excel, PowerPoint, Outlook, Access, Visio, OneNote, SharePoint, and Teams (desktop and Android). The bulk of the flaws are memory-corruption issues (stack/heap buffer overflows, use-after-free, double-free, out-of-bounds read/write, off-by-one and numeric conversion errors) that lead to remote code execution when a user is convinced to open a malicious file or follow a malicious link. Other classes include deserialization of untrusted data, SSRF, authorization bypass, and improper authorization, mostly affecting SharePoint and resulting in privilege escalation or spoofing/impersonation.

The two most severe issues are both in Microsoft SharePoint: CVE-2026-109454 (CVSS 9.0), a cross-site scripting flaw that an authenticated attacker can exploit over the network to perform spoofing, and CVE-2026-120002 (CVSS 9.9), caused by insufficient authorization checks that let an authenticated attacker escalate privileges remotely. The advisory also lists dozens of CVSS 8.8 remote-code-execution bugs spread across Word, Excel, PowerPoint, Outlook, Access, Visio and OneNote, most requiring a victim to open a crafted document or link (no indication of zero-click exploitation). SharePoint also carries a cluster of CVSS 7.3–8.8 spoofing/impersonation and elevation-of-privilege bugs.

No in-the-wild exploitation is reported by NCSC-NL or referenced MSRC entries at time of publication; this is a routine patch-cycle advisory. Defenders should prioritize patching SharePoint servers (especially CVE-2026-109454 and CVE-2026-120002) and roll out the broader Office update set via standard patch management, since the volume of RCE-capable bugs across commonly used client applications (Word, Excel, PowerPoint, Outlook) makes phishing-delivered malicious documents the most likely exploitation vector going forward.

## Mentioned in this report

- Vulnerabilities: CVE-2026-109454, CVE-2026-109464, CVE-2026-109466, CVE-2026-109472, CVE-2026-109493, CVE-2026-109494, CVE-2026-109496, CVE-2026-109501, CVE-2026-109502, CVE-2026-109503, CVE-2026-109505, CVE-2026-110043, CVE-2026-110044, CVE-2026-110047, CVE-2026-110048, CVE-2026-110050, CVE-2026-110058, CVE-2026-110068, CVE-2026-111296, CVE-2026-111297, CVE-2026-111309, CVE-2026-112734, CVE-2026-112737, CVE-2026-116717, CVE-2026-116924, CVE-2026-116926, CVE-2026-116927, CVE-2026-118292, CVE-2026-118293, CVE-2026-118700, CVE-2026-119994, CVE-2026-120001, CVE-2026-120002, CVE-2026-120003, CVE-2026-120005, CVE-2026-122198, CVE-2026-122979, CVE-2026-123375, CVE-2026-80095, CVE-2026-88176

## Detection guidance (public sample)

### Office Application Spawning Script Interpreter or LOLBin

ATT&CK: T1204.002

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Office client apps (Word, Excel, PowerPoint, Outlook, Access, Visio, OneNote) launching shells, script hosts or download/proxy-execution binaries, the expected post-exploitation pattern for malicious documents that abuse Office RCE bugs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning Script Interpreter or LOLBin
id: 645ff05b-ce6f-53b3-8ced-8fef5bbc48db
status: experimental
description: Detects Office client applications spawning command interpreters, script
  hosts or common proxy-execution/download binaries. This is the typical child-process
  pattern after a phishing-delivered document exploits a memory-corruption flaw or
  runs a macro. Generalises on the parent/child relation, not on any specific CVE.
tags:
- attack.execution
- attack.t1204.002
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \OUTLOOK.EXE
    - \MSACCESS.EXE
    - \VISIO.EXE
    - \ONENOTE.EXE
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \regsvr32.exe
    - \rundll32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Excel or Access macros/add-ins in line-of-business workflows that call cmd.exe or
  PowerShell
- Outlook add-ins or helper tools that launch rundll32.exe for file handling
level: medium
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0474.html
```

### SharePoint IIS Worker Process Spawning Shell

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

w3wp.exe running a SharePoint application pool spawning cmd/PowerShell, indicating exploitation of SharePoint RCE/deserialization flaws or webshell activity. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SharePoint IIS Worker Process Spawning Shell
id: 1c6adb8a-f547-5bd2-9bc8-30bb6e439f56
status: experimental
description: Detects the IIS worker process serving a SharePoint application pool
  spawning a command interpreter. SharePoint server flaws (deserialization of untrusted
  data, authorization bypass, RCE) are commonly exploited to run commands from w3wp.exe.
  Generalises on the parent/child pattern, not on specific CVEs.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    ParentCommandLine|contains: SharePoint
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Custom SharePoint farm solutions or timer-style web parts that intentionally shell
  out to cmd.exe
level: high
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0474.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0474.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9ef0a97b-d9c2-5968-b02d-84983a6890ab/microsoft-patches-180-office-flaws-including-sharepoint-rce.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup