What is the CVSS score of CVE-2026-48560?

CVE-2026-48560 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.5%.

Is there a patch available for CVE-2026-48560?

Yes, a patch is available for CVE-2026-48560. Update the affected software to the latest version immediately.

Microsoft SharePoint CVE-2026-48560

EUVD-2026-35583 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-06-09 secure@microsoft.com

GHSA-3rrj-xq44-843h

Microsoft XSS Deserialization Sharepoint Server

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ENISA EUVD

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:05 vuln.today

Patch available

Jun 09, 2026 - 19:03 EUVD

CVE Published

Jun 09, 2026 - 17:17 nvd

MEDIUM 5.4

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

AnalysisAI

Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) enables low-privileged authenticated attackers to perform spoofing attacks over a network without requiring user interaction. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-reachable exploitation by any authenticated SharePoint user with no further interaction required from a victim. No public exploit identified at time of analysis and CISA SSVC classifies exploitation status as none, though vendor patches are available for all three affected product lines.

Technical ContextAI

Microsoft SharePoint Server is an enterprise web-based collaboration and document management platform built on ASP.NET. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) in the NVD/EUVD data, yet the CVE description identifies the root cause as CWE-79-class improper input neutralization during web page generation - a notable inconsistency. The tags supplied include both 'XSS' and 'Deserialization', suggesting the root cause may be deserialized content that is subsequently rendered without proper output encoding, creating an XSS-reachable spoofing surface. Affected CPE data (inferred from EUVD versions) covers SharePoint's core server component across the 16.0.x release branch: Subscription Edition prior to 16.0.19725.20384, SharePoint Server 2019 prior to 16.0.10417.20153, and SharePoint Enterprise Server 2016 prior to 16.0.5556.1005.

RemediationAI

Vendor-released patches are available for all three affected product lines. Upgrade Microsoft SharePoint Server Subscription Edition to 16.0.19725.20384 or later, SharePoint Server 2019 to 16.0.10417.20153 or later, and SharePoint Enterprise Server 2016 to 16.0.5556.1005 or later. Consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48560 for the specific cumulative update (CU) packages applicable to each product. If patching cannot be applied immediately, consider restricting SharePoint access to trusted internal networks or authenticated VPN segments, which reduces the network-accessible attack surface. Additionally, reviewing and tightening SharePoint user permissions to minimize the pool of accounts with contributor-level or higher access limits who can trigger the vulnerability, though this may affect legitimate collaboration workflows. Note that the CWE-502 tag may indicate deserialization is involved - if confirmed by Microsoft, organizations should also review SharePoint's list of trusted deserialization sources as a compensating control.