EUVD-2026-44175
GHSA-r9f8-rwrc-5664
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Authenticated contributor (PR:L) and victim interaction (UI:R) are required; stored XSS crosses trust scope (S:C) and steals/impersonates session data (C:H), with limited integrity and no availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacker to inject script that executes in another user's browser session, enabling spoofing across a network. The scope-changed CVSS 3.1 rating of 8.7 (vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) reflects the ability to break out of the vulnerable component's security context and impact victim data. Microsoft has released patches; there is no public exploit identified at time of analysis and CISA SSVC currently records exploitation as none.
Technical ContextAI
SharePoint is Microsoft's enterprise collaboration and document-management platform, deployed on-premises in the affected SKUs: SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition (CPEs cpe:2.3:a:microsoft:microsoft_sharepoint_enterprise_server_2016, :microsoft_sharepoint_server_2019, and :microsoft_sharepoint_server_subscription_edition). The root cause is CWE-79, improper neutralization of user-supplied input during web page generation, meaning content submitted by one user (for example page fields, list items, or web-part content) is rendered back to other users without adequate output encoding. When a victim views the crafted content, injected script runs in the SharePoint origin, which the CVSS scope change (S:C) indicates can affect resources beyond the immediately vulnerable component - consistent with stored/reflected XSS in a shared collaboration surface.
RemediationAI
Vendor-released patch: apply the Microsoft security updates that raise builds to at least 16.0.10417.20175 (SharePoint Server 2019), 16.0.19725.20434 (SharePoint Server Subscription Edition), or 16.0.5561.1001 (SharePoint Enterprise Server 2016), following the guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55034. Because exploitation requires an authenticated low-privileged user and victim interaction, interim compensating controls if immediate patching is not possible include restricting who can author or contribute content to sensitive sites (tighten site/list contribute permissions to reduce the pool of potential injectors), reviewing and limiting custom web parts and HTML-enabled fields, and enforcing a strict Content-Security-Policy at the reverse proxy to constrain inline script execution - noting that aggressive CSP or field restrictions can break legitimate custom pages and web parts and should be tested first. These are stopgaps only; the update remains the definitive fix.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today