Skip to main content

Sharepoint Server CVE-2026-26105

HIGH
Cross-site Scripting (XSS) (CWE-79)
2026-03-10 secure@microsoft.com
XSS Microsoft Sharepoint Server
8.1
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious SharePoint page content
  2. Delivery
    Inject XSS payload into web page generation
  3. Exploit
    Victim clicks malicious link
  4. Execution
    Execute JavaScript in victim's browser
  5. Impact
    Steal session tokens or redirect to phishing site

Vulnerability Assessment

Weakness
CWE
CWE-79
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK

2 techniques across 2 tactics: Initial Access, Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

SharePoint web page generation endpoint accepts unsanitized user input without proper output encoding. Attacker requires victim user interaction (UI:R) to click crafted link. No authentication required for initial payload delivery.
Impact

CVSS 8.1 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: Required. Exploitation no authentication required. Exploitable via remote/network.
Exploit ScenarioDerived

A remote attacker without authentication could exploit this vulnerability to compromise the affected system.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Microsoft SharePoint Server contains a reflected cross-site scripting vulnerability that allows remote attackers to execute arbitrary scripts in users' browsers through malicious links, enabling spoofing attacks and credential theft. The vulnerability requires user interaction to trigger and affects all SharePoint deployments with no available patch. With a CVSS score of 8.1, this poses a significant risk to organizations relying on SharePoint for collaboration.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:55 CVSS 8.1

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. [CVSS 8.1 HIGH]

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.

Affected Packages

microsoft sharepoint_enterprise_server_2016_16_0_5543_1000 fix: Microsoft SharePoint Enterprise Server 2016 16.0.5543.1000
microsoft sharepoint_server_2019_16_0_10417_20102 fix: Microsoft SharePoint Server 2019 16.0.10417.20102
microsoft sharepoint_server_subscription_edition_16_0_19725_20076 fix: Microsoft SharePoint Server Subscription Edition 16.0.19725.20076

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in microsoft

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-79 (Cross-site Scripting (XSS)). Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Know when Sharepoint Server gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

DescriptionCVE.org

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Executive ViewAI

Why It Matters

A high-severity cross-site scripting vulnerability in Microsoft SharePoint (CVE-2026-26105) enables attackers to impersonate users and manipulate content through spoofing attacks, potentially compromising sensitive business documents and user trust. This poses immediate risk to organizations relying on SharePoint for document management, collaboration, and information security.

Business Impact: High
Compensating Controls

Implement WAF rules targeting XSS attack patterns in SharePoint URLs and content; enable network segmentation to limit SharePoint access to trusted internal networks only; disable or restrict web part functionality that could be leveraged for malicious script injection; enforce Content Security Policy (CSP) headers; require multi-factor authentication for SharePoint access; disable anonymous and guest access where operationally feasible; implement strict input validation and output encoding at application level if custom web parts are deployed; increase security monitoring and logging for SharePoint activity with alerts on suspicious pattern detection.

Threat Intelligence Overview

EPSS Score
0.0%
Top 85% exploitable
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Cross-Site Scripting MEDIUM

Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.

Affected Products (CPE)CVE.org

cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*
cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*
cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*

More in Sharepoint Server

View all
CVE-2025-53770 CRITICAL POC
9.8 Jul 20

Microsoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
CVE-2025-49704 HIGH POC
8.8 Jul 08

Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
CVE-2025-49706 MEDIUM POC
6.5 Jul 08

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
CVE-2023-21716 CRITICAL POC
9.8 Feb 14

Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
CVE-2013-1315 CRITICAL POC
9.3 Sep 11

Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
CVE-2015-2468 CRITICAL POC
9.3 Aug 15

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
CVE-2015-0064 CRITICAL POC
9.3 Feb 11

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
CVE-2013-1330 CRITICAL
10.0 Sep 11

The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
CVE-2026-65660 HIGH POC
8.8 Aug 11

Code injection (CWE-94) in Microsoft SharePoint Server exposes authenticated network users to high-impact compromise acr
CVE-2013-0006 HIGH
8.8 Jan 09

Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
CVE-2013-3889 CRITICAL
9.3 Oct 09

Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
CVE-2013-3858 CRITICAL
9.3 Sep 11

Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2024-52875 HIGH POC
8.8

References

Advisories & patches
ADVISORY https://vuldb.com/?id.350030 REF https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26105

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy