What is the CVSS score of CVE-2026-45481?

CVE-2026-45481 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Microsoft SharePoint are affected by CVE-2026-45481?

A cross-site scripting vulnerability in Microsoft Office SharePoint (CVE-2026-45481, CVSS 7.3) allows authenticated low-privileged users to inject malicious scripts that execute in other users'…. A patch is available.

How to fix or mitigate CVE-2026-45481?

Within 24 hours: Enumerate all SharePoint deployments and low-privileged user account inventory; assess whether permissions can be restricted to read-only access where operationally feasible to limit attack surface. Within 7 days: Deploy Web Application Firewall (WAF) rules to detect and block XSS payloads; enable comprehensive audit logging on all SharePoint sites and establish daily review procedures for unauthorized modifications. Within 30 days: Subscribe to Microsoft security advisories and CISA KEV notifications for immediate patch release notification; develop and test a SharePoint patch deployment plan including rollback procedures; evaluate deploying SharePoint in restricted-access configuration for highly sensitive data repositories.

Microsoft SharePoint CVE-2026-45481

EUVD-2026-35580 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 secure@microsoft.com

GHSA-89px-wpg3-4f42

XSS Microsoft Sharepoint Server

5.4

CVSS 3.1 · NVD

Temporal: 6.4

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.4 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jun 12, 2026 - 16:22 NVD

HIGH MEDIUM

CVSS changed

Jun 12, 2026 - 16:22 NVD

7.3 (HIGH) 5.4 (MEDIUM)

Analysis Generated

Jun 09, 2026 - 18:21 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.3

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

AnalysisAI

Stored or reflected cross-site scripting in Microsoft Office SharePoint allows an authenticated low-privileged attacker to inject script that executes in another user's browser session, enabling spoofing and high-impact disclosure or modification of data rendered in the victim's context. The CVSS 7.3 vector requires user interaction and existing access to the SharePoint site, and no public exploit identified at time of analysis. The flaw is consistent with the CWE-79 class of input neutralization failures during web page generation.

Technical ContextAI

Microsoft Office SharePoint is an enterprise collaboration and document-management platform that renders user-supplied content (list items, web part properties, document metadata, comments, page fields) inside HTML responses. CWE-79 indicates the server fails to neutralize special characters before reflecting input into generated pages, so attacker-controlled markup or script is parsed by the victim browser as part of the trusted SharePoint origin. Because SharePoint shares a single-sign-on session with other Microsoft 365 services, script executing in that origin inherits the victim's authenticated context for SharePoint content APIs.

RemediationAI

Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45481 once the exact build for your SharePoint edition is identified; the supplied data does not include a fixed version, so this is treated as patch available per vendor advisory. Until patching, reduce exposure by restricting site-creation and contributor permissions to trusted users (since PR:L access is needed to plant payloads), enforcing the SharePoint HTML Field Security setting to strip script from rich-text fields, and ensuring the X-XSS-Protection and Content-Security-Policy headers configured by the farm are not relaxed by custom master pages - note that tightening CSP can break legacy web parts and custom script extensions, so test in a staging collection. For SharePoint Online tenants, Microsoft typically patches centrally, so verify the message-center notice for tenant rollout status rather than assuming immediate coverage.