EUVD-2026-45063
GHSA-xpgg-r72x-rgc7
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L because a valid SharePoint account is required; UI:R because victim must render injected content; S:U and C:L/I:L as impact is application-scoped with no availability effect.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Stored or reflected cross-site scripting in Microsoft SharePoint Server allows an authenticated low-privileged attacker to inject malicious script content that executes in a victim's browser, enabling spoofing attacks over a network. Affected deployments span SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. No public exploit code or active CISA KEV listing has been identified; the CVSS 4.6 Medium rating reflects the dual prerequisites of authentication and victim interaction, which materially constrain real-world exploitability.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize or encode user-supplied data before it is rendered in browser-facing HTML output. In SharePoint's context - a rich enterprise collaboration platform handling documents, lists, wikis, and user-generated web parts - multiple input surfaces exist where untrusted content could be embedded and later served to other users. The CPE strings confirm three distinct server products are affected: cpe:2.3:a:microsoft:microsoft_sharepoint_enterprise_server_2016, cpe:2.3:a:microsoft:microsoft_sharepoint_server_2019, and cpe:2.3:a:microsoft:microsoft_sharepoint_server_subscription_edition, all with wildcard version ranges indicating broad coverage within each major release line. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:U confirms a network-delivered, low-complexity attack that requires a low-privilege account and victim interaction but stays scoped within the application boundary.
RemediationAI
Patch available per vendor advisory - apply the Microsoft-released security update for the relevant SharePoint server version (2016, 2019, or Subscription Edition) via the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62826. Exact fix version numbers were not specified in the available input data and should be confirmed directly from the MSRC advisory before deployment. As a compensating control pending patching, consider restricting the ability of low-privilege users to submit rich HTML or script-capable content in SharePoint list fields, web parts, or wiki pages by enforcing stricter content-type policies or disabling HTML-field rendering on sensitive sites - note this may break legitimate rich-text authoring workflows. Content Security Policy (CSP) headers, if configurable in the SharePoint environment, can limit the impact of script injection by restricting script execution origins.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today