EUVD-2026-44166
GHSA-c9qw-72v3-rp2r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to SharePoint with low-privilege account
-
DeliveryStore crafted XSS payload in list/page
-
ExploitVictim opens malicious content
-
ExecutionScript executes in victim session
-
ImpactSpoof UI or steal session data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold an authenticated SharePoint account with at least contribute/edit rights sufficient to store content (PR:L), and it requires a victim user to interact by viewing the attacker-injected content (UI:R) - the attack is not self-triggering or automatable per CISA SSVC. The attacker must reach a SharePoint web front-end over the network (AV:N), so the affected 2016/2019/Subscription Edition servers must be accessible to the attacker. Limiting factors: exploitation fails against fully patched builds, is bounded to whatever the victim's browser session can do within the SharePoint origin, and depends on tricking or waiting for a suitable victim to open the malicious content, which constrains reliability and scale. |
| Impact | Signals are mixed and point to a real but not emergency-grade priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, score 8.7) indicates a network-reachable, low-complexity attack that nonetheless requires low-level privileges (an authenticated SharePoint account) and victim user interaction, with a scope change and high confidentiality/integrity impact. CISA's SSVC framework rates Exploitation as none, Automatable as no, and Technical Impact as total - so while a successful attack fully compromises the victim's session context, it is not currently exploited and cannot be mass-automated. There is no CISA KEV listing and no POC referenced, and no EPSS score was provided in the input. Net assessment: a genuinely high-severity XSS worth prioritized patching in exposed collaboration environments, but the PR:L and UI:R requirements plus 'no known exploitation' temper it below drop-everything urgency. The high 8.7 score is driven largely by the scope change and total technical impact rather than by ease or evidence of real-world abuse. |
| Exploit ScenarioDerived | An attacker with a valid low-privilege SharePoint account crafts a list item, page, or web part containing malicious script and stores it where other users will view it. When a higher-privileged user opens that content, the script executes in their authenticated SharePoint session, letting the attacker spoof trusted UI or exfiltrate/act on data within the victim's context. No public exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 15, 2026
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Edition) allows an authenticated attacker to inject script that executes in another user's browser session across a network. CVSS is 8.7 with a scope change, reflecting that injected content escapes into the victim's authenticated context; there is no public exploit identified at time of analysis and CISA SSVC rates exploitation status as none. A vendor patch is available via Microsoft MSRC.
Earlier versions of this analysis (1)
Stored/reflected cross-site scripting (CWE-79) in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Edition) lets an authenticated, low-privileged attacker inject script that executes in a victim's browser session, enabling spoofing over the network. Microsoft rates it CVSS 7.3 with high confidentiality and integrity impact, though the described primary effect is spoofing; there is no public exploit identified at time of analysis and it is not on CISA KEV. A vendor patch is available via the Microsoft Update Guide.
RemediationAI
Apply the Microsoft security update referenced in the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55021), upgrading to the fixed builds: SharePoint Enterprise Server 2016 to 16.0.5561.1001 or later, SharePoint Server 2019 to 16.0.10417.20175 or later, and SharePoint Server Subscription Edition to 16.0.19725.20434 or later (Vendor-released patch confirmed available per vendor advisory). Until patching, reduce exposure by restricting who can author or contribute content to sites (limit contribute/edit permissions to trusted users, since exploitation requires an authenticated low-privilege account), and consider fronting SharePoint with a WAF tuned to strip or encode script payloads in stored fields - noting a WAF may cause false positives on legitimate rich content and is not a substitute for the update. Avoid exposing SharePoint web front-ends directly to the internet where feasible; the trade-off is reduced external collaboration convenience.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-79 (improper neutralization of input during web page generation) issue in SharePoint's server-side rendering of user-supplied content. SharePoint is Microsoft's on-premises collaboration and document management platform, and affected editions per CPE are microsoft_sharepoint_enterprise_server_2016, microsoft_sharepoint_server_2019, and microsoft_sharepoint_server_subscription_edition. Because SharePoint stores and re-renders user-authored content (lists, pages, web parts, metadata) to other users, insufficient output encoding lets attacker-controlled markup persist and later execute as script in a victim's browser within the trusted SharePoint origin - the classic stored/persistent XSS pattern that Microsoft categorizes here as a network spoofing impact.
Know when Microsoft Sharepoint Enterprise Server 2016 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Network-reachable stored XSS needing an authenticated low-priv account (PR:L) and victim viewing (UI:R); script escapes into the victim's trusted origin (S:C) with high C/I and no availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Executive ViewAI
A stored cross-site scripting vulnerability in Microsoft SharePoint (Enterprise Server 2016, 2019, and Subscription Edition) enables authenticated attackers to inject malicious scripts that execute in other users' browser sessions, risking data theft and account compromise across enterprise collaboration platforms. The vulnerability's CVSS score of 8.7 reflects scope change-injected content escapes into victims' authenticated contexts. Microsoft has released a vendor patch requiring immediate deployment.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Exploit-DB