What is the CVSS score of CVE-2026-33113?

CVE-2026-33113 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-33113?

Yes, a patch is available for CVE-2026-33113. Update the affected software to the latest version immediately.

Microsoft SharePoint CVE-2026-33113

EUVD-2026-35531 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 secure@microsoft.com

GHSA-fq8f-fjfp-487h

XSS Microsoft Sharepoint Server

6.1

CVSS 3.1 · NVD

Temporal: 4.7

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

4.7 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jun 11, 2026 - 19:07 NVD

5.4 (MEDIUM) 6.1 (MEDIUM)

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 19:00 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

MEDIUM 5.4

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

AnalysisAI

Cross-site scripting in Microsoft SharePoint enables network-based spoofing attacks by injecting malicious scripts into web page output. The vulnerability (CWE-79) targets users of the SharePoint web interface and, when triggered via user interaction, allows an attacker to manipulate page content or impersonate legitimate UI elements - degrading both confidentiality and integrity. No public exploit or active exploitation has been identified at time of analysis, though the low-complexity network vector lowers the bar for opportunistic abuse.

Technical ContextAI

The vulnerability is an improper neutralization of user-controlled input during HTML/JavaScript generation (CWE-79, Cross-Site Scripting) in Microsoft Office SharePoint. SharePoint is a web-based collaboration platform that renders user-supplied content within browser contexts; insufficient output encoding or input sanitization allows attacker-controlled strings to be interpreted as executable script by the victim's browser. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) indicates the flaw is reachable over the network without elevated privileges but requires the victim to take an action - consistent with a reflected or stored XSS pattern where a crafted link or page interaction triggers execution. No CPE strings were provided in the source data; exact affected SharePoint versions are not independently confirmed from available intelligence.

RemediationAI

The primary remediation is to apply Microsoft's official patch as detailed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33113. An exact fixed version number was not provided in the source intelligence; consult the advisory directly for the specific cumulative update or patch KB article. For SharePoint Server on-premises deployments where immediate patching is not feasible, consider restricting anonymous or external user access to SharePoint web surfaces to reduce the unauthenticated attack surface, noting this may disrupt extranet collaboration scenarios. For SharePoint Online (Microsoft 365), Microsoft typically applies patches automatically; verify tenant update status via the Microsoft 365 Admin Center. Additionally, deploying a Content Security Policy (CSP) header - where SharePoint configuration allows - can limit XSS script execution scope as a compensating control, though this does not eliminate the underlying vulnerability.