EUVD-2026-56777
GHSA-vm6j-2v8f-3j42
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Network-accessible SharePoint requires low-privilege authentication and active victim interaction for spoofing impact; no availability impact and no scope change apply.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Spoofing in Microsoft SharePoint Server allows an authenticated low-privilege network attacker to manipulate content presentation or deceive users through improper input validation, achieving limited confidentiality and integrity impact. Affected deployments span SharePoint Server 2016 Enterprise, 2019, and Subscription Edition across a wide range of versions prior to their respective Microsoft-patched builds. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires both a low-privilege authenticated session and victim user interaction, constraining realistic threat scope.
Technical ContextAI
Microsoft SharePoint Server is an enterprise collaboration and content management platform built on ASP.NET. CWE-20 (Improper Input Validation) identifies the root cause: the server fails to adequately validate attacker-supplied input before processing or rendering it, enabling spoofed content to be injected or presented in ways that misrepresent data to end users. CPE strings confirm three distinct product lines are affected: cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:* (Subscription Edition), cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:* (2016 Enterprise), and cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* (2019). The spoofing class of vulnerability in SharePoint typically manifests as crafted content that bypasses validation and renders deceptively in user browsers or client interfaces, potentially facilitating phishing or social engineering within trusted SharePoint contexts.
RemediationAI
The primary remediation is to apply the vendor-released patches: upgrade SharePoint Server 2019 to 16.0.10417.20198 or later, SharePoint Enterprise Server 2016 to 16.0.5565.1001 or later, and SharePoint Server Subscription Edition to 16.0.19725.20522 or later. Full patch details and download links are available via the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62917. As a compensating control prior to patching, restricting SharePoint access to trusted authenticated users and limiting the ability of low-privilege users to submit or publish unreviewed content can reduce the spoofing attack surface; however, this may impact collaboration workflows. Monitoring SharePoint audit logs for anomalous content submissions by low-privilege accounts can support detection while patching is in progress.
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Ap
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today