EUVD-2026-35644
GHSA-p445-hh2v-j393
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Stored or reflected cross-site scripting in Microsoft SharePoint on-premises deployments enables an authenticated attacker to perform spoofing attacks against other users over a network. Affected products span three major on-premises release lines: SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. The CVSS vector (PR:L, UI:R) confirms exploitation requires a low-privileged authenticated account and victim user interaction, meaningfully constraining opportunistic attack. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize attacker-controlled input before it is rendered as part of a dynamically generated HTML page. In Microsoft SharePoint - a web-based enterprise collaboration and document management platform - user-supplied content (such as page fields, metadata, or web part input) may be reflected or stored and subsequently rendered without adequate output encoding, allowing injection of arbitrary JavaScript or HTML. Affected CPE-equivalent products as identified by ENISA EUVD are Microsoft SharePoint Enterprise Server 2016 (versions below 16.0.5556.1005), Microsoft SharePoint Server 2019 (versions below 16.0.10417.20153), and Microsoft SharePoint Server Subscription Edition (versions below 16.0.19725.20384). This vulnerability class in SharePoint has historically been leveraged for session hijacking, credential phishing, and UI redress attacks within enterprise intranet environments. The scope is unchanged (S:U), meaning the injected script executes within the SharePoint application's own security context rather than breaking into adjacent systems.
RemediationAI
Vendor-released patches are available for all three affected product lines. Administrators should update Microsoft SharePoint Enterprise Server 2016 to version 16.0.5556.1005 or later, Microsoft SharePoint Server 2019 to version 16.0.10417.20153 or later, and Microsoft SharePoint Server Subscription Edition to version 16.0.19725.20384 or later, as documented in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45467 and cross-referenced in ENISA EUVD-2026-35644. If immediate patching is not feasible, compensating controls should include restricting SharePoint site creation and page-editing permissions to a minimal set of trusted users (reducing the PR:L attack surface), enabling SharePoint's built-in HTML field security settings to strip script tags from user input where supported, and deploying a web application firewall rule to detect and block reflected XSS payloads in SharePoint HTTP responses - noting that WAF rules may produce false positives on legitimate rich-text content. User awareness around clicking unknown SharePoint links from internal users can also reduce UI:R exploitation success. None of these compensating controls fully substitute for patching.
More in Sharepoint Server
View allMicrosoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Ap
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today