What is the CVSS score of CVE-2026-47634?

CVE-2026-47634 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Microsoft SharePoint are affected by CVE-2026-47634?

A stored or reflected cross-site scripting vulnerability in Microsoft Office SharePoint (CVE-2026-47634, CVSS 7.3) allows authenticated users with low privileges to inject malicious scripts that…. A patch is available.

How to fix or mitigate CVE-2026-47634?

Within 24 hours: Enable audit logging on all SharePoint sites and configure alerts for script injection patterns; review and restrict excessive user permissions, removing low-privileged accounts with unnecessary content creation rights. Within 7 days: Deploy Web Application Firewall (WAF) rules to block common XSS payloads on SharePoint endpoints; implement Content Security Policy (CSP) headers restricting inline script execution; conduct mandatory phishing and malicious link awareness training for all SharePoint users. Within 30 days: Monitor Microsoft Security Response Center (MSRC) advisories for patch release; develop and test patch deployment procedures; consider implementing network-based access restrictions (VPN/corporate networks only) and MFA requirement for all SharePoint access as persistent controls pending patch availability.

Microsoft SharePoint CVE-2026-47634

EUVD-2026-35577 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-09 secure@microsoft.com

GHSA-529m-597h-84cr

XSS Microsoft Sharepoint Server

5.4

CVSS 3.1 · NVD

Temporal: 6.4

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.4 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jul 09, 2026 - 00:22 NVD

HIGH MEDIUM

CVSS changed

Jul 09, 2026 - 00:22 NVD

7.3 (HIGH) 5.4 (MEDIUM)

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 17:54 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.3

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

AnalysisAI

Stored or reflected cross-site scripting in Microsoft Office SharePoint allows an authenticated attacker with low privileges to inject malicious script that, after victim interaction, results in spoofing and disclosure or alteration of sensitive content within a victim's browser session. The CVSS 7.3 (AV:N/AC:L/PR:L/UI:R) rating reflects network-reachable exploitation with low complexity but requires both a valid SharePoint account and user interaction. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, 'Injection'), specifically manifesting as cross-site scripting in SharePoint's web page generation pipeline. SharePoint renders user-controllable content (list items, web parts, document metadata, page fields) into HTML responses, and one or more of these rendering paths fails to properly encode attacker-supplied input before it reaches the victim's browser. When the malicious payload executes in the victim's authenticated SharePoint session, it inherits the victim's origin and cookies, enabling impersonation and content manipulation within the SharePoint web application.

RemediationAI

Apply the security update published by Microsoft as referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47634; exact fix build numbers should be obtained from that advisory as the input data does not include a confirmed patched version. Patch available per vendor advisory. As compensating controls until patches are deployed, restrict SharePoint account creation and tighten permissions so that only trusted users can author or edit content in shared sites and lists (reducing the pool of PR:L attackers), enforce Content Security Policy headers where supported to limit inline script execution, ensure browsers and Microsoft 365 Defender / EDR are up to date to catch post-exploitation behavior, and educate users to avoid clicking unexpected SharePoint links or previewing untrusted content. Note that tightening permissions may impact collaboration workflows and CSP changes can break legitimate SharePoint customizations.