EUVD-2026-35545
GHSA-prmc-xf2g-2f6m
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition enables network-based spoofing attacks by injecting malicious scripts into rendered web page output. The vulnerability carries a CVSS 5.4 (Medium) score with low attack complexity and no privilege requirement per the CVSS vector, but requires victim user interaction - a pattern consistent with reflected or stored XSS leading to in-browser script execution within a trusted SharePoint domain. No public exploit code or CISA KEV listing has been identified at time of analysis, though the broad enterprise deployment footprint of SharePoint elevates real-world relevance beyond the moderate CVSS score.
Technical ContextAI
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), meaning SharePoint fails to properly sanitize or encode attacker-supplied input before embedding it in HTML responses served to other users. SharePoint's web-based collaboration surfaces - including list views, page editors, and metadata fields - represent potential injection points where unsanitized content could be rendered as executable script. All three affected product lines (Enterprise Server 2016, Server 2019, and Subscription Edition) share the 16.x codebase, as evidenced by their version strings. XSS in an enterprise intranet platform is particularly dangerous because users inherently trust SharePoint pages, and the platform regularly handles sensitive document content, user identity context, and authentication tokens. The vulnerability was reported by Microsoft's own security team (secure@microsoft.com) and tracked additionally as EUVD-2026-35545.
RemediationAI
Apply vendor-released patches immediately: upgrade Microsoft SharePoint Enterprise Server 2016 to version 16.0.5556.1005 or later, Microsoft SharePoint Server 2019 to version 16.0.10417.20153 or later, and Microsoft SharePoint Server Subscription Edition to version 16.0.19725.20384 or later. Patch details are documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45465. If patching cannot be applied immediately, consider the following compensating controls with their stated trade-offs: restrict contributor-level write access to SharePoint pages and list columns to trusted users only (reduces attack surface but limits collaboration functionality); enforce SharePoint's built-in HTML Field Security feature to strip unsafe markup from rich-text fields (may break legitimate HTML-formatted content); and deploy a Content Security Policy header via a reverse proxy or WAF to restrict script execution origins (CSP bypass is possible and this is not a patch substitute, but raises exploitation cost). Monitor SharePoint Unified Audit Logs for anomalous page edits or script-like strings in content fields.
More in Sharepoint Server
View allMicrosoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Ap
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today