What is the CVSS score of CVE-2026-47641?

CVE-2026-47641 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-47641?

Yes, a patch is available for CVE-2026-47641. Update the affected software to the latest version immediately.

Microsoft SharePoint CVE-2026-47641

EUVD-2026-35513 MEDIUM

Improper Input Validation (CWE-20)

2026-06-09 secure@microsoft.com

GHSA-7r9v-jph7-65jv

XSS Microsoft Sharepoint Server

5.4

CVSS 3.1 · NVD

Temporal: 4.0

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

4.0 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jul 09, 2026 - 00:22 NVD

4.6 (MEDIUM) 5.4 (MEDIUM)

Analysis Generated

Jun 09, 2026 - 19:33 vuln.today

Patch available

Jun 09, 2026 - 19:03 EUVD

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

AnalysisAI

Cross-site scripting in Microsoft SharePoint allows an authenticated network attacker with low privileges to inject malicious script content into web pages, enabling spoofing attacks against other users. All three active SharePoint server product lines - Server 2019, Enterprise Server 2016, and Subscription Edition - are affected across broad version ranges. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; vendor-released patches are available for all affected product lines.

Technical ContextAI

Microsoft SharePoint is an enterprise collaboration and document management platform where users create, share, and render web-based content. The root cause is listed as CWE-20 (Improper Input Validation), manifesting as XSS - user-supplied input is not properly neutralized before being rendered in HTML page generation contexts. Affected products span three product lines all running on the 16.0.x code base: SharePoint Server 2019 (below 16.0.10417.20153), SharePoint Enterprise Server 2016 (below 16.0.5556.1005), and SharePoint Server Subscription Edition (below 16.0.19725.20384). The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U) identifies this as a network-accessible flaw with unchanged scope, consistent with a reflected or stored XSS pattern that executes within the victim's browser session without escaping to the server tier.

RemediationAI

Apply the vendor-released patches identified in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47641. Specific target versions are: SharePoint Server 2019 - upgrade to 16.0.10417.20153 or later; SharePoint Enterprise Server 2016 - upgrade to 16.0.5556.1005 or later; SharePoint Server Subscription Edition - upgrade to 16.0.19725.20384 or later. These fix versions are confirmed by EUVD-2026-35513 data. As a compensating control prior to patching, restricting SharePoint access to internal networks or VPN-only reduces external attack surface, though this will impact legitimate remote workers. Enforcing a strict Content Security Policy header on SharePoint web applications can limit the impact of script execution if triggered, but does not remediate the underlying input validation flaw. Monitoring SharePoint audit logs for unusual content creation or page modification activity by low-privilege accounts can aid in early detection.