What is the CVSS score of CVE-2026-45453?

CVE-2026-45453 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-45453?

Yes, a patch is available for CVE-2026-45453. Update the affected software to the latest version immediately.

Microsoft SharePoint CVE-2026-45453

EUVD-2026-35667 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 secure@microsoft.com

GHSA-2rfr-f6x3-9p9m

XSS Microsoft Sharepoint Server

5.4

CVSS 3.1 · NVD

Temporal: 4.7

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

4.7 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:50 vuln.today

Patch available

Jun 09, 2026 - 19:03 EUVD

CVE Published

Jun 09, 2026 - 17:17 nvd

MEDIUM 5.4

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

AnalysisAI

Cross-site scripting in Microsoft SharePoint Server on-premises deployments (2016, 2019, and Subscription Edition) enables network-based spoofing attacks by injecting malicious script into pages rendered within victims' browser sessions. All three actively supported SharePoint on-premises product lines are affected across broad version ranges, with fixed releases confirmed in the June 2026 patch cycle. No public exploit code has been identified at time of analysis and the vulnerability is absent from the CISA KEV catalog, but low attack complexity and wide enterprise deployment footprint make prompt patching a reasonable priority.

Technical ContextAI

Microsoft SharePoint is an enterprise collaboration and document management platform built on ASP.NET that renders user-supplied and content-derived data within authenticated browser sessions. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-controlled input is written into HTML responses without adequate output encoding, allowing injected script to execute in a victim's browser context under the SharePoint origin. Affected products share the 16.x code branch: SharePoint Enterprise Server 2016 below 16.0.5556.1005, SharePoint Server 2019 below 16.0.10417.20153, and SharePoint Server Subscription Edition below 16.0.19725.20384, as confirmed by ENISA EUVD-2026-35667 CPE data. The vulnerability class is a classic reflected or stored XSS pattern within the SharePoint web rendering pipeline.

RemediationAI

Apply the vendor-released patches for each affected product line: upgrade SharePoint Enterprise Server 2016 to 16.0.5556.1005 or later, SharePoint Server 2019 to 16.0.10417.20153 or later, and SharePoint Server Subscription Edition to 16.0.19725.20384 or later, all available through the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45453. Where patching must be deferred, restricting SharePoint site contribution permissions to trusted internal users limits who can inject content into shared pages - this reduces attack surface but may impact intended collaboration workflows. Deploying a Web Application Firewall with XSS filtering rules at the perimeter, or enforcing strict Content-Security-Policy headers via a reverse proxy, can reduce the impact of successful injection by blocking inline script execution; however, neither control is a substitute for patching and both carry compatibility risks with SharePoint's native JavaScript-heavy interface.