EUVD-2026-35542
GHSA-hvr7-96wf-c34f
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Stored or reflected cross-site scripting in Microsoft SharePoint Server enables an authenticated network attacker to perform spoofing attacks against other users by injecting malicious script into web page output. Affected products span three SharePoint Server product lines - 2016 Enterprise, 2019, and Subscription Edition - all on build version 16.0.x below their respective patched thresholds. Microsoft has released patches across all affected branches; no public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a class of flaws where attacker-controlled input is reflected or persisted into HTML output without adequate encoding or sanitization, causing the browser to execute injected script in the context of the targeted origin. SharePoint Server, as a web-based collaboration and document management platform, exposes numerous user-controlled input surfaces - page titles, metadata fields, web parts, list items - any of which could serve as the injection vector. The affected CPE spans SharePoint Server 2016 Enterprise (16.0.0 < 16.0.5556.1005), SharePoint Server 2019 (16.0.0 < 16.0.10417.20153), and SharePoint Server Subscription Edition (16.0.0 < 16.0.19725.20384), all sharing the same 16.0.x build versioning lineage. The network-accessible (AV:N) nature of SharePoint means the vulnerable endpoint is reachable without local system access.
RemediationAI
Patch available per vendor advisory - organizations should update to the patched builds identified in EUVD-2026-35542: SharePoint Server 2019 should be updated to build 16.0.10417.20153 or later; SharePoint Server Subscription Edition to 16.0.19725.20384 or later; SharePoint Enterprise Server 2016 to 16.0.5556.1005 or later. Patching guidance and download links are available through the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45462. Until patching is complete, compensating controls include restricting SharePoint content-creation permissions to trusted users only (reducing the PR:L attacker pool), enabling Content Security Policy headers at the reverse proxy or WAF layer to limit script execution from injected payloads, and monitoring SharePoint audit logs for unusual page or list modifications by low-privilege accounts. Note that CSP enforcement may affect legitimate SharePoint web parts and should be tested in a staging environment before production rollout.
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Ap
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today