SharePoint Server CVE-2026-70355

The attacker must hold a valid SharePoint account with at minimum contributor-level permissions sufficient to submit or edit content on the affected instance (PR:L in CVSS). A second user - the victim - must actively interact with the attacker-injected content in their authenticated browser session (UI:R in CVSS). SharePoint must be reachable over the network (AV:N). Exploitation is not automatable per SSVC, meaning the attacker must socially engineer or otherwise direct the victim to the malicious content. There is no requirement for a specific non-default configuration beyond the attacker having write access to any SharePoint content area visible to higher-privileged users. Exploitation is limited by the need for a valid account (eliminating fully unauthenticated external attackers) and mandatory victim interaction (eliminating server-side-only exploitation).

Despite a CVSS base score of 8.7, real-world risk is moderated by several factors. The PR:L metric requires the attacker to hold a valid SharePoint account, and UI:R means a victim must actively access the attacker-controlled content - neither condition is trivially bypassed at scale. The SSVC assessment confirms exploitation status as none and automatable as no, meaning this attack cannot be efficiently mass-exploited with current tools. EPSS at 0.42% (35th percentile) further corroborates low near-term exploitation probability. That said, SSVC technical impact is rated total, and the CVSS scope change means a successful attack achieves C:H and I:H - full read and write access within the victim's SharePoint session - which is genuinely severe in sensitive enterprise environments where SharePoint hosts confidential documents, HR data, or operational processes. The risk profile is: low likelihood of opportunistic exploitation, but high-consequence for targeted attacks against privileged SharePoint users (e.g., site administrators or document owners). Patch urgency is elevated in environments where SharePoint is internet-facing or accessible to untrusted authenticated users.

An authenticated SharePoint user with contributor-level access crafts a page or list item containing obfuscated JavaScript and shares or links it to a higher-privileged target user (such as a site administrator). When the target visits the content in their browser, the malicious script executes under the SharePoint origin, harvesting session tokens or performing administrative actions - such as granting the attacker elevated permissions - on behalf of the victim. No public exploit code is identified at time of analysis, but the attack pattern is well-understood for CWE-79 in collaboration platforms.