What is the CVSS score of CVE-2026-47639?

CVE-2026-47639 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-47639?

Yes, a patch is available for CVE-2026-47639. Update the affected software to the latest version immediately.

Microsoft SharePoint CVE-2026-47639

EUVD-2026-35512 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 secure@microsoft.com

GHSA-552j-3hqv-4389

XSS Microsoft Sharepoint Server

5.4

CVSS 3.1 · NVD

Temporal: 4.7

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

4.7 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:34 vuln.today

Patch available

Jun 09, 2026 - 19:03 EUVD

CVE Published

Jun 09, 2026 - 17:17 nvd

MEDIUM 5.4

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

AnalysisAI

Cross-site scripting in Microsoft SharePoint Server enables network-based spoofing attacks by injecting malicious scripts into rendered web pages, requiring victim user interaction to trigger. Three SharePoint server product lines are affected across the 16.0.x code branch, with vendor-released patches available for all. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as a failure to sanitize or encode user-supplied input before rendering it in SharePoint-generated web pages, permitting injection of client-side script. The vulnerability resides in the server-side web content generation layer shared across SharePoint Server Subscription Edition, SharePoint Enterprise Server 2016, and SharePoint Server 2019, all operating on the 16.0.x codebase. When exploited, the injected script executes within the victim's browser in the context of the SharePoint origin, enabling spoofing actions such as UI redirection, session token theft, or forged content presentation.

RemediationAI

Apply the vendor-released patches immediately: upgrade SharePoint Server Subscription Edition to 16.0.19725.20384 or later, SharePoint Enterprise Server 2016 to 16.0.5556.1005 or later, and SharePoint Server 2019 to 16.0.10417.20153 or later, as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47639. If patching cannot be applied immediately, consider deploying Content Security Policy (CSP) headers at the reverse proxy or WAF layer to restrict inline script execution - note this may break SharePoint's own JavaScript-dependent UI features and requires careful testing. Additionally, restricting SharePoint access to known internal IP ranges reduces exposure if internet-facing, though it does not eliminate insider or compromised-account risk. Review and tighten SharePoint site permissions to limit which users can submit or modify content, reducing the attacker's ability to plant malicious payloads.