EUVD-2026-44207
GHSA-rmf4-c853-35q8
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network XSS needing an authenticated account (PR:L) and victim interaction (UI:R); stored XSS in same origin keeps S:U, and realistic session-scoped impact is Low rather than High.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Stored/reflected cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Edition) lets an authenticated attacker inject script that executes in another user's browser session to spoof content over the network. Although Microsoft classifies the impact as 'spoofing,' the CVSS 3.1 vector rates confidentiality and integrity as High (C:H/I:H), indicating the injected script can access or alter sensitive session data. There is no public exploit identified at time of analysis, and a vendor patch is available.
Technical ContextAI
The flaw is a CWE-79 improper neutralization of user-controlled input during web page generation. SharePoint renders user-supplied content (list items, web parts, document metadata, or wiki/page fields) into HTML; when input is not properly encoded, an attacker's markup executes as script in the context of the SharePoint site origin. Affected components per CPE are the on-premises server products microsoft_sharepoint_enterprise_server_2016, microsoft_sharepoint_server_2019, and microsoft_sharepoint_server_subscription_edition. Because the payload runs in the victim's authenticated session against a trusted enterprise portal, it can hijack the SharePoint UI, read page content, and act on the victim's behalf within the same origin (scope unchanged, S:U).
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-55126 to all affected SharePoint Enterprise Server 2016, Server 2019, and Subscription Edition farms via the Microsoft Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55126 (exact fix build numbers are published there; confirm them before deployment). Until the update is installed, reduce exposure by restricting untrusted or low-privilege users from creating or editing content in sensitive sites, limiting external/anonymous access to affected web applications, and ensuring the SharePoint web application enforces a strict Content Security Policy and HTML field security settings - with the trade-off that tightening HTML field security may break legitimate custom scripts or embedded content. Deploying a WAF rule to filter script-bearing input into SharePoint forms can provide interim coverage but may generate false positives on legitimate rich-text content.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today