EUVD-2026-35511
GHSA-v273-fx7c-xfq2
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft SharePoint allows an authenticated low-privilege network attacker to inject malicious script content into SharePoint pages, enabling spoofing attacks against victim users who render the affected content. Three product lines are affected: SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, all at specific 16.0.x build levels. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.6 Medium score reflects meaningful risk reduction from the dual prerequisites of authenticated access and required victim interaction.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied input is insufficiently encoded or sanitized before being rendered as HTML output, allowing an attacker to embed executable script content into the SharePoint web interface. Microsoft SharePoint is a widely-deployed enterprise collaboration and document management platform built on ASP.NET; its rich content editing surfaces (pages, lists, web parts) represent common XSS injection points. The affected product lines - SharePoint Enterprise Server 2016 (build < 16.0.5556.1005), SharePoint Server 2019 (build < 16.0.10417.20153), and SharePoint Server Subscription Edition (build < 16.0.19725.20384) - all share the 16.0.x codebase, suggesting the flaw exists in a shared rendering component. The spoofing impact described by Microsoft is consistent with XSS patterns where injected content can impersonate UI elements or redirect user interactions within the trusted SharePoint origin.
RemediationAI
Apply vendor-released patches as follows: upgrade SharePoint Enterprise Server 2016 to build 16.0.5556.1005 or later, SharePoint Server 2019 to build 16.0.10417.20153 or later, and SharePoint Server Subscription Edition to build 16.0.19725.20384 or later, per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47638. If immediate patching is not operationally feasible, restrict contributor and edit permissions to trusted users only, reducing the pool of accounts that can inject content into SharePoint pages and lists - note this may impact legitimate collaboration workflows. Deploying or tightening a Content Security Policy (CSP) header at the reverse proxy or WAF layer to restrict script execution origins can serve as a secondary control, but requires careful tuning to avoid breaking SharePoint's own JavaScript-dependent UI components. Monitor SharePoint audit logs for unusual page or list modifications by low-privilege accounts as a detection measure during the remediation window.
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Ap
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today