EUVD-2026-56291
GHSA-pgjm-4362-2w4c
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L confirmed by requirement for authenticated SharePoint account; UI:R because victim must view injected content; S:C for cross-user browser execution stealing victim session.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft SharePoint Server enables an authenticated low-privilege attacker to inject malicious scripts into SharePoint content that execute in a victim user's browser, enabling session token theft, credential harvesting, or on-behalf-of actions under the victim's identity. Affected products are SharePoint Server Subscription Edition prior to 16.0.19725.20522 and SharePoint Server 2019 prior to 16.0.10417.20198. Vendor-released patches are available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The vulnerability is a CWE-79 (Improper Neutralization of Special Elements Used in a Web Page - Cross-site Scripting) flaw in Microsoft SharePoint Server's web page generation layer. SharePoint renders user-supplied content such as page fields, list items, or web parts as HTML without sufficient output encoding, allowing attacker-controlled script to be embedded in rendered pages. The CVSS scope change (S:C) is the defining characteristic here: injected code executes not in the attacker's browser session but in the victim's, crossing the security boundary between the attacker's SharePoint context and the victim's authenticated session. Affected CPEs are cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:* (Subscription Edition) and cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* (2019). Both product lines share the 16.0.x codebase.
RemediationAI
Apply the vendor-released patches immediately: upgrade SharePoint Server Subscription Edition to version 16.0.19725.20522 or later, and SharePoint Server 2019 to version 16.0.10417.20198 or later, as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57105. If patching cannot be applied immediately, restrict SharePoint contributor and edit permissions to the minimum set of trusted internal identities, reducing the attacker pool - note this may disrupt collaboration workflows and should be coordinated with content owners. Additionally, review and tighten Content Security Policy headers on SharePoint if your deployment supports custom HTTP response headers, though native SharePoint CSP support is limited and testing in a non-production environment is essential before rollout to avoid breaking legitimate functionality.
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Ap
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today