What is the CVSS score of CVE-2026-48562?

CVE-2026-48562 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-48562?

Yes, a patch is available for CVE-2026-48562. Update the affected software to the latest version immediately.

Microsoft SharePoint CVE-2026-48562

EUVD-2026-35584 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 secure@microsoft.com

GHSA-c276-pxpr-hv78

XSS Microsoft Sharepoint Server

4.6

CVSS 3.1 · NVD

Temporal: 4.0

Severity by source

NVD PRIMARY

4.6 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

4.0 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:05 vuln.today

Patch available

Jun 09, 2026 - 19:03 EUVD

CVE Published

Jun 09, 2026 - 17:17 nvd

MEDIUM 4.6

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

AnalysisAI

Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) enables an authenticated attacker with low-level network access to inject malicious scripts into SharePoint-generated web pages, resulting in spoofing attacks against other users. The vulnerability requires victim interaction to trigger script execution, limiting automated exploitation. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; the CVSS score of 4.6 reflects the constrained impact and authentication prerequisite.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize or encode attacker-controlled data before it is rendered in a user's browser. In SharePoint's case, an authenticated user can supply crafted input to a SharePoint component that is later reflected or stored and served to other users without adequate output encoding. The vulnerability affects three distinct SharePoint server product lines: SharePoint Server 2019 (all 16.0.x builds prior to 16.0.10417.20153), SharePoint Enterprise Server 2016 (all 16.0.x builds prior to 16.0.5556.1005), and SharePoint Server Subscription Edition (all 16.0.x builds prior to 16.0.19725.20384), as identified via EUVD-2026-35584. The network attack vector (AV:N) confirms the payload is delivered and executed via the browser over the network, consistent with a web-based XSS vector.

RemediationAI

Vendor-released patches are available for all three affected product lines: upgrade SharePoint Server 2019 to build 16.0.10417.20153 or later, SharePoint Enterprise Server 2016 to build 16.0.5556.1005 or later, and SharePoint Server Subscription Edition to build 16.0.19725.20384 or later. The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48562 provides download and deployment guidance. As a compensating control where immediate patching is not feasible, restrict SharePoint content-creation permissions to the minimum necessary set of trusted users, reducing the population of accounts that could inject malicious content. Additionally, enabling SharePoint's built-in HTML field security settings (HtmlFieldSecurity) to restrict permitted HTML in rich-text fields can limit the surface area for script injection, though this may affect legitimate formatting use cases and does not replace patching.