EUVD-2026-99739
GHSA-38q4-vgf7-jhvh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged SharePoint user
-
DeliveryInject malicious script into rendered field
-
ExploitVictim views crafted content
-
ExecutionScript executes in victim's session
-
ImpactSpoof content or hijack authenticated context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated SharePoint account (PR:L) on Microsoft SharePoint Server Subscription Edition (versions prior to 16.0.20326.20190) and a victim who interacts with the attacker-supplied content (UI:R) - the malicious script only executes when another user renders the affected web page. Limiting factors: the attacker cannot act fully unauthenticated, the payload does not self-trigger (a victim must view it), and only the unpatched version range is vulnerable. These constraints meaningfully reduce the realistic attack surface compared to the 7.3 base score, making targeted abuse by an existing user the most plausible path. |
| Impact | This is a moderate-priority vulnerability that merits scheduled patching rather than emergency response. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, base 7.3) indicates a network-reachable attack of low complexity, but with two meaningful brakes: the attacker must already hold low-level privileges (PR:L - an authenticated SharePoint user) and a victim must be induced to interact (UI:R). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent exploitation; per the inputs this is 'no public exploit identified at time of analysis.' A notable internal tension exists: the description characterizes the impact as 'spoofing,' yet the vendor CVSS vector asserts C:H and I:H (high confidentiality and integrity impact). For a CWE-79 cross-site scripting flaw this high C/I pairing is typical of session/token theft and content manipulation in the victim's authenticated context, but the 'spoofing' label alone understates that - verify the concrete impact with Microsoft's advisory. Overall: a genuine but not top-of-queue issue, gated by authentication and user interaction, affecting high-value infrastructure. |
| Exploit ScenarioDerived | An authenticated low-privilege SharePoint user injects a malicious script into a field that is rendered to other users without proper neutralization. When a higher-privileged victim views the crafted content, the script executes in their authenticated browser session, enabling token theft or UI spoofing in the SharePoint context. No public exploit code was identified in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Cross-site scripting in Microsoft SharePoint Server Subscription Edition (builds prior to 16.0.20326.20190) allows an authenticated user with a valid SharePoint account to plant script content that executes in the browser of another user who views the affected page, enabling spoofing and theft or manipulation of data within that victim's session context. The defect carries a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N), which reflects a meaningful prerequisite chain: the attacker must already hold an authenticated account (PR:L) and the payload only fires when a victim interacts with the crafted content (UI:R). There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so this is a moderate-priority vulnerability that merits scheduled patching rather than emergency response.
RemediationAI
Vendor-released patch: Microsoft has published a fix for SharePoint Server Subscription Edition, and installations should be updated to build 16.0.20326.20190 or later following the guidance in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88204 (patch status listed as available from vendor). Because the vulnerability requires an authenticated account plus victim interaction, the exploit window is narrower than the 7.3 base score suggests, so patching can be scheduled through normal change management rather than treated as an emergency - but it should not be deferred indefinitely given the collaboration platform's typical exposure. If immediate patching is not possible, compensating controls include tightening who can contribute content (remove or restrict Contribute/Design permissions for untrusted users and disable self-service site creation), which reduces the pool of accounts able to plant a payload but does not eliminate risk from already-privileged insiders. Deploying a web application firewall or reverse proxy with XSS/HTML-injection signatures in front of the farm can catch common payload patterns but will not detect context-specific encoding flaws and may generate false positives that break legitimate rich-text content; enabling strict output encoding and Content Security Policy headers reduces script execution but can break SharePoint web parts and custom solutions that rely on inline script. Note that these are temporary mitigations with functional trade-offs - the vendor patch remains the only complete fix, and no workaround restores full protection.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79, improper neutralization of input during web page generation - SharePoint fails to correctly encode or sanitize attacker-supplied content before embedding it in a generated HTML page, so markup or script supplied by one user is rendered and executed in the origin of another. This is the classic stored/persistent XSS pattern in a collaboration platform: because SharePoint serves pages on a shared origin and relies on cookie/claims-based authentication, script running in the victim's browser can act with that victim's privileges against the site. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N is important context: scope is unchanged (S:U), so impact is confined to the victim's browser/session and the resources SharePoint considers the same security authority, rather than allowing a full boundary break or server-side code execution. Confidentiality and integrity are rated High on the client side while availability is Not impacted, consistent with a spoofing/data-manipulation outcome rather than denial of service. Per the EUVD record (EUVD-2026-99739), the vulnerable artifact is Microsoft SharePoint Server Subscription Edition at version 16.0.0 below 16.0.20326.20190; the CPE data provided does not enumerate additional product branches, and the MSRC update guide is the authoritative source for the precise affected build list.
Know when Sharepoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Network-delivered XSS requiring an authenticated user (PR:L) and victim interaction (UI:R); script runs in the victim's authenticated context yielding high C/I, no availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Executive ViewAI
Microsoft SharePoint Server Subscription Edition (builds prior to 16.0.20326.20190) contains a cross-site scripting flaw that lets any user with a valid SharePoint account inject script that runs in a colleague's browser session, exposing internal content and allowing data within that session to be read or altered. Because exploitation requires only an ordinary authenticated account and a victim who views a crafted page, the exposure scales with the size of the organization's SharePoint user base rather than with external attacker access, and a successful attack can undermine trust in shared document repositories and collaboration workflows. No public exploit code or active exploitation has been identified at this time, so remediation can proceed on a scheduled cycle while access controls and monitoring are tightened.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Sharepoint
View allRemote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authen
SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted
Authenticated code injection in Microsoft SharePoint (CVSS 3.1 base 8.8) allows a remote attacker holding a valid low-pr
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190)
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.2
Authenticated path traversal in Microsoft SharePoint Server can be escalated to code execution over the network, allowin
Privilege escalation in Microsoft SharePoint Server Subscription Edition before build 16.0.20326.20190 allows a remote l
Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated remote attacker holding
Privilege elevation in Microsoft SharePoint Server Subscription Edition lets any attacker who already holds a valid low-
Privilege escalation in Microsoft SharePoint allows an authenticated low-privileged user to invoke functionality that la
Exploit-DB