SharePoint Server, Azure DevOps Server and SQL Server Get Critical Fixes in November 2026 Patch Tuesday

TL;DR

Microsoft patched a CVSS 9.9 SharePoint Server vulnerability, CVE-2026-120002, in its November 2026 Patch Tuesday. The same release fixes a 9.9 remote code execution bug in Azure DevOps Server and a 9.8 flaw in SQL Server. In addition, Microsoft disclosed a CVSS 10.0 issue in Entra Device Registration.

Three on-premises server products received critical fixes this month. SQL Server’s bug needs no login, while the SharePoint and DevOps flaws need only a low-privileged account. No exploitation has been reported, but admins should patch these servers quickly.

Why It Matters

SharePoint, Azure DevOps Server and SQL Server often hold an organization’s most sensitive data and code. Moreover, SharePoint is a frequent target. CISA’s catalog lists 16 exploited SharePoint flaws, four of them added since July 2026.

For now, CISA’s assessment in each CVE record lists exploitation as “none.” Microsoft also rates exploit maturity as “Unproven.”

How the Attack Works

CVE-2026-120002: SharePoint Server (CVSS 9.9)

This SharePoint Server vulnerability stems from incorrect authorization. According to Microsoft, it “allows an authorized attacker to elevate privileges over a network.” The scope-changed vector means impact can spread beyond SharePoint itself.

CVE-2026-109467: Azure DevOps Server (CVSS 9.9)

An improper authentication flaw lets a logged-in attacker “execute code over a network.” As a result, a single low-privileged account could reach the build and code pipeline.

CVE-2026-116945: SQL Server (CVSS 9.8)

Here, a heap-based buffer overflow lets an unauthorized attacker run code remotely. Notably, CISA tags it as “Automatable,” since no login or user action is needed.

CVE-2026-109469: Entra Device Registration (CVSS 10.0)

Finally, an authorization bypass through a user-controlled key affects this cloud service. Microsoft hosts this service, so admins should check the advisory for any customer steps.

Affected Versions

• Microsoft SharePoint Server Subscription Edition
• Azure DevOps Server 2025
• SQL Server 2017, 2019, 2022 and 2025, in both GDR and CU branches
• Entra Device Registration (cloud service)

Patch and Mitigation

Apply the November updates to every SharePoint Server, Azure DevOps Server and SQL Server instance. For SQL Server, pick the GDR or CU package that matches your current branch. Also keep SQL Server ports off the internet. Treat this SharePoint Server vulnerability as a priority on any internet-facing farm.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.