EUVD-2026-99741
GHSA-mfm4-x9fq-3v9p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged SharePoint user
-
DeliveryInject XSS payload into content field
-
ExploitVictim opens affected page
-
ExecutionScript executes in victim browser
-
ImpactSpoof trusted content or session context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated SharePoint account with the ability to submit or edit content that is rendered to other users (PR:L), plus victim interaction - a second user must view or interact with the page containing the injected payload (UI:R). This is therefore not a zero-click or unauthenticated flaw: both an existing tenant foothold and social/workflow-driven victim interaction are needed. Affected deployments are Microsoft SharePoint Server Subscription Edition 16.0.0 prior to build 16.0.20326.20190; patched builds are not vulnerable. Impact is limited to spoofing with low confidentiality and integrity effects and no availability impact, and the unchanged scope (S:U) means execution stays within the SharePoint security context. |
| Impact | This is a genuinely low-priority issue despite being network-exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, base 4.6 Medium) shows the attacker needs existing privileges (PR:L - an authenticated SharePoint user) and must lure a victim into interacting (UI:R), yielding only low confidentiality and integrity impact and no availability impact. Every corroborating signal points the same direction: SSVC reports Exploitation=none, Automatable=no, and Technical Impact=partial; the CVE is NOT on CISA KEV; and no public POC is referenced. There are no conflicting signals here - the moderate CVSS, the low-severity SSVC outcome, and the absence of exploitation evidence are consistent. EPSS is not provided in the input, so exploitation probability cannot be quantified. The realistic characterization is a low-impact stored/reflected XSS enabling spoofing within a SharePoint tenant, requiring both a foothold and victim interaction, with no evidence of real-world exploitation. |
| Exploit ScenarioDerived | An authenticated SharePoint user with permission to submit content injects a crafted script payload into a field that is rendered without proper neutralization. When another user views the affected page, the script executes in their browser session, enabling spoofing of trusted content or UI within the SharePoint origin. No public exploit code is identified, and successful exploitation depends on the victim interacting with the malicious content. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Stored cross-site scripting in Microsoft SharePoint Server Subscription Edition (16.0.0 builds prior to 16.0.20326.20190) allows an authenticated user who can author or edit content to inject script that later executes in the browser of a different user who views the affected page, resulting in spoofed page content. Exploitation requires a valid SharePoint account with content-editing rights and victim interaction, so it is neither unauthenticated nor zero-click; the assessed impact is limited to spoofing with low confidentiality and integrity consequences and no availability impact. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation, making this a low-priority, patch-on-normal-cycle issue rather than an emergency.
RemediationAI
Apply the vendor fix from Microsoft's update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88208), which resolves the issue for SharePoint Server Subscription Edition by bringing the installation to build 16.0.20326.20190 or later; patch status is recorded as available from the vendor, so no emergency compensating controls are required, though normal phishing and content-authoring risk justifies timely deployment. If the patch must be deferred, reduce the attack surface directly: tighten who holds content-authoring, page-editing, and 'Manage Lists' permissions so untrusted tenants cannot submit the malicious markup in the first place (trade-off: restricts legitimate contributors and can hamper collaboration workflows); remove or restrict unmanaged custom web parts, script editors, and SharePoint Designer/scriptable page customizations that widen the injection surface (trade-off: breaks existing customized pages); and deploy a strict Content-Security-Policy on the SharePoint front end to blunt script execution even when encoding fails (trade-off: requires testing and can break inline-script-dependent UI). Advise users to treat unexpected or suspicious SharePoint pages and links as phishing until the environment is patched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-79 improper neutralization of input during web page generation - classic cross-site scripting - in the SharePoint web front end. When SharePoint renders user-supplied content (page content, list items, web part properties, or wiki/rich-text fields) it fails to correctly encode or sanitize attacker-controlled input, so markup and script survive into the HTML returned to other users. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N describes exactly this shape: reachable over the network with low attack complexity, but gated behind a low-privileged authenticated account (PR:L) and requiring the victim to interact with the crafted page (UI:R). Because the scope is unchanged (S:U), script execution remains confined to the SharePoint origin and the security context of the viewing user rather than escalating to the host OS, which is why the assessed confidentiality and integrity impact is low - the practical abuse case is content spoofing, session/token theft against the SharePoint site, or tricking users into revealing information, not server-side code execution.
Know when Sharepoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Authenticated contributor needed so PR:L; stored/reflected XSS requires a victim to view the page (UI:R); low C/I impact and no availability effect, scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Sharepoint
View allRemote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authen
SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted
Authenticated code injection in Microsoft SharePoint (CVSS 3.1 base 8.8) allows a remote attacker holding a valid low-pr
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190)
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.2
Authenticated path traversal in Microsoft SharePoint Server can be escalated to code execution over the network, allowin
Privilege escalation in Microsoft SharePoint Server Subscription Edition before build 16.0.20326.20190 allows a remote l
Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated remote attacker holding
Privilege elevation in Microsoft SharePoint Server Subscription Edition lets any attacker who already holds a valid low-
Privilege escalation in Microsoft SharePoint allows an authenticated low-privileged user to invoke functionality that la
Exploit-DB