EUVD-2026-35645
GHSA-rrcf-jg65-9c46
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft SharePoint Server allows an authenticated low-privileged attacker to inject malicious scripts into SharePoint-generated web pages, enabling spoofing attacks against other authenticated users over the network. Three product lines are confirmed affected: SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016, each with specific patched build thresholds. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all three product lines.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a class of vulnerabilities where user-controlled input is incorporated into dynamically generated HTML without adequate encoding or sanitization, allowing injection of executable script content. In Microsoft SharePoint, this manifests in the web page rendering layer - likely within content editing, list items, or page field inputs - where attacker-controlled data is reflected or stored and later served to other users without proper output encoding. CPE-confirmed affected products are Microsoft SharePoint Server Subscription Edition (baseline 16.0.0, fixed at 16.0.19725.20384), SharePoint Server 2019 (baseline 16.0.0, fixed at 16.0.10417.20153), and SharePoint Enterprise Server 2016 (baseline 16.0.0, fixed at 16.0.5556.1005). The CVSS vector AV:N/AC:L/PR:L/UI:R/S:U indicates a network-reachable, low-complexity attack requiring low-privilege authentication and victim interaction, with unchanged scope and limited confidentiality and integrity impact.
RemediationAI
The primary fix is to update to the Microsoft-released patched builds: SharePoint Server Subscription Edition to build 16.0.19725.20384 or later, SharePoint Server 2019 to build 16.0.10417.20153 or later, and SharePoint Enterprise Server 2016 to build 16.0.5556.1005 or later. Patch details and download links are available via the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45468. As a compensating control prior to patching, organizations can restrict the ability of low-privileged or guest users to create or edit SharePoint pages and list content - this directly removes the injection surface but may impact collaboration workflows. Additionally, enforcing strict Content Security Policy (CSP) headers at the WAF or reverse-proxy layer can reduce the exploitability of reflected or stored XSS by blocking inline script execution, though SharePoint's reliance on JavaScript-heavy UI may require careful policy tuning to avoid breaking functionality.
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Ap
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today