EUVD-2026-44162
GHSA-mfv2-jh7j-29w3
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Authenticated content injection (PR:L) via network (AV:N), victim browser interaction required (UI:R), scope change to victim context (S:C), limited confidentiality and integrity impact only.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Edition) allows an authenticated attacker with low-privilege access to inject malicious JavaScript into SharePoint-rendered pages, which then executes in the browsers of other users who view the content, enabling spoofing and session-context abuse. The CVSS PR:L requirement confirms unauthenticated exploitation is not possible, and the UI:R requirement means the attack depends on victim interaction. No public exploit code has been identified, SSVC rates exploitation as none with partial technical impact, and the EPSS score of 0.38% (30th percentile) indicates low near-term exploitation probability.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause - user-supplied input is not properly sanitized or output-encoded before being rendered within SharePoint's web interface, allowing injected scripts to execute in the security context of other users' browsers. Microsoft SharePoint is a web-based collaboration and document management platform built on ASP.NET, where rich content creation by users is a core feature, creating natural XSS attack surfaces in list items, pages, and web parts. The CVSS S:C (scope changed) metric reflects that the injected payload operates in the victim's browser security context rather than the server's own context. Affected products per CPE data are cpe:2.3:a:microsoft:microsoft_sharepoint_enterprise_server_2016, cpe:2.3:a:microsoft:microsoft_sharepoint_server_2019, and cpe:2.3:a:microsoft:microsoft_sharepoint_server_subscription_edition, all covering the 16.0.x release line with specific patched version thresholds confirmed via EUVD-2026-44162.
RemediationAI
Apply the vendor-released patches available through Microsoft's standard update channels: upgrade SharePoint Enterprise Server 2016 to version 16.0.5561.1001 or later, SharePoint Server 2019 to 16.0.10417.20175 or later, and SharePoint Server Subscription Edition to 16.0.19725.20434 or later, as confirmed by the Microsoft MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55019. As a compensating control while patching is scheduled, restrict SharePoint content-creation and page-editing permissions to the smallest necessary set of users, reducing the pool of accounts that could inject malicious content; note that this trade-off limits collaboration capabilities. Enforcing Content Security Policy (CSP) headers at the reverse proxy or WAF layer to restrict script execution origins can reduce XSS impact, though misconfigured CSP may break legitimate SharePoint functionality and requires thorough testing before deployment.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today