EUVD-2026-44170
GHSA-h4jf-r4ph-w6hv
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-delivered XSS requiring a low-privileged account to inject and victim browser interaction to trigger; scope changes to victim session, no availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition enables an authenticated network attacker to inject malicious scripts into SharePoint pages, causing spoofing against users who view the affected content. The vulnerability carries a CVSS 5.4 (Medium) score with an EPSS of 0.38% (30th percentile), indicating low current exploitation probability. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; a vendor-released patch is available via the Microsoft Security Response Center.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize user-supplied input before embedding it in dynamically generated HTML, allowing script injection. In this case, SharePoint's web page generation pipeline fails to neutralize attacker-controlled input, yielding a reflected or stored XSS condition. Affected CPEs span three distinct SharePoint server product lines - cpe:2.3:a:microsoft:microsoft_sharepoint_enterprise_server_2016, cpe:2.3:a:microsoft:microsoft_sharepoint_server_2019, and cpe:2.3:a:microsoft:microsoft_sharepoint_server_subscription_edition - all running build versions prior to the patched releases identified in EUVD-2026-44170. SharePoint's architecture as a browser-rendered collaboration platform makes XSS particularly impactful because users routinely trust and interact with SharePoint-hosted content within corporate intranets.
RemediationAI
The primary fix is to apply the vendor-released patches addressing all three product lines. For SharePoint Enterprise Server 2016, upgrade to build 16.0.5561.1001 or later; for SharePoint Server 2019, upgrade to build 16.0.10417.20175 or later; and for SharePoint Server Subscription Edition, upgrade to build 16.0.19725.20434 or later. Patch details are available via the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55030. If immediate patching is not feasible, compensating controls include restricting SharePoint content editing rights to a minimal set of trusted users (reducing the pool of accounts that could inject malicious content), enabling Content Security Policy (CSP) headers at the reverse proxy or WAF layer to limit inline script execution, and increasing monitoring of SharePoint audit logs for unusual page edits or script-like content submissions. Note that CSP enforcement at the proxy layer may interfere with legitimate SharePoint functionality that relies on inline scripts, so testing in a staging environment before production deployment is advised.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today