EUVD-2026-44223
GHSA-x557-mg8m-x23m
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-accessible XSS requiring authenticated low-privilege user and victim interaction; scope changes to victim browser with partial confidentiality and integrity impact only.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, Server 2019, and Server Subscription Edition enables authenticated network attackers to inject malicious scripts that execute in victims' browsers, enabling spoofing, session hijacking, or unauthorized actions on behalf of targeted users. The CWE-79 flaw requires victim interaction (UI:R) and low-privilege attacker credentials (PR:L), but the changed scope (S:C) means impact extends beyond the SharePoint server into the victim's browser session. No public exploit identified at time of analysis; EPSS of 0.28% (20th percentile) and SSVC exploitation rating of 'none' indicate low immediate threat despite broad enterprise deployment.
Technical ContextAI
CWE-79 (Cross-Site Scripting) describes a failure to neutralize user-supplied input before it is rendered as HTML or JavaScript in downstream web pages. In SharePoint's case, an authenticated user with content-authoring or page-editing permissions can embed malicious script payloads into SharePoint pages or list items. When a victim browses to that content, the browser executes the injected script in the SharePoint origin context, granting access to session cookies, local storage, and the ability to issue authenticated requests. The CVSS S:C (Scope Changed) metric confirms the impact crosses from the SharePoint application into the victim's browser trust boundary. Three distinct product lines are confirmed affected by CPE data: cpe:2.3:a:microsoft:microsoft_sharepoint_enterprise_server_2016, cpe:2.3:a:microsoft:microsoft_sharepoint_server_2019, and cpe:2.3:a:microsoft:microsoft_sharepoint_server_subscription_edition, all on the 16.x code branch.
RemediationAI
Vendor-released patches are available for all three affected product lines. Upgrade Microsoft SharePoint Enterprise Server 2016 to build 16.0.5561.1001 or later, SharePoint Server 2019 to build 16.0.10417.20175 or later, and SharePoint Server Subscription Edition to build 16.0.19725.20434 or later. Patch details and download links are available via the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55135. If immediate patching is not feasible, restrict content-authoring and page-editing permissions to the minimum required set of trusted users, as this reduces the pool of accounts that could inject malicious content; however, this trade-off limits collaboration capabilities. Additionally, enforcing Content Security Policy (CSP) headers at the reverse proxy or WAF layer can reduce XSS exploitability by restricting script execution origins, though SharePoint's own CSP support is limited and WAF rules may cause false positives on legitimate SharePoint functionality.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today