What is the CVSS score of CVE-2026-47636?

CVE-2026-47636 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-47636?

Yes, a patch is available for CVE-2026-47636. Update the affected software to the latest version immediately.

Microsoft SharePoint CVE-2026-47636

EUVD-2026-35509 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 secure@microsoft.com

GHSA-hrxq-fxxr-mf4w

XSS Microsoft Sharepoint Server

5.4

CVSS 3.1 · NVD

Temporal: 4.7

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

4.7 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:35 vuln.today

Patch available

Jun 09, 2026 - 19:03 EUVD

CVE Published

Jun 09, 2026 - 17:17 nvd

MEDIUM 5.4

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

AnalysisAI

Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) enables network-based spoofing attacks against authenticated users who interact with attacker-controlled content. The vulnerability stems from insufficient input neutralization during web page generation (CWE-79), allowing injected script to execute in a victim's browser context. No public exploit code has been identified at time of analysis, and a vendor-released patch is available via Microsoft's Security Response Center.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied input is reflected or stored without adequate encoding or sanitization before being rendered as HTML in the browser. In SharePoint's context, this typically occurs through list fields, page content, or web part parameters that fail to sanitize input before output. Affected CPE-equivalent versions span all three major on-premises SharePoint Server product lines: SharePoint Enterprise Server 2016 (build < 16.0.5556.1005), SharePoint Server 2019 (build < 16.0.10417.20153), and SharePoint Server Subscription Edition (build < 16.0.19725.20384). The vulnerability class allows injected JavaScript to run in the victim's browser session under the SharePoint origin, enabling spoofing of content or user context.

RemediationAI

Apply the vendor-released patches via Microsoft's cumulative update process: SharePoint Enterprise Server 2016 should be updated to build 16.0.5556.1005 or later; SharePoint Server 2019 to build 16.0.10417.20153 or later; and SharePoint Server Subscription Edition to build 16.0.19725.20384 or later, all as referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47636. If immediate patching is not feasible, restrict access to the specific SharePoint features or web parts suspected of reflecting unsanitized input, and enforce Content Security Policy (CSP) headers at the reverse proxy or WAF layer to limit script execution origins - note that CSP mitigations may affect legitimate SharePoint functionality and should be tested before broad deployment. Additionally, enforce strict input validation at the WAF level for SharePoint-bound HTTP requests containing script-like patterns as a compensating control.