EUVD-2026-99740
GHSA-jxfq-782p-3mxc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged SharePoint user
-
DeliveryInject crafted script into vulnerable field
-
ExploitVictim opens affected page
-
ExecutionScript executes in victim browser
-
ImpactSpoof content or impersonate actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to hold a valid authenticated SharePoint account with at least low-level privileges (PR:L) sufficient to submit content into a field that is rendered to other users, and it further requires a victim user to view/interact with the attacker-controlled content (UI:R). It is therefore not usable against unauthenticated outsiders and cannot execute without victim interaction; impact is limited to low confidentiality and integrity (spoofing/content manipulation within the web application), with no availability impact. Affected deployments are SharePoint Server Subscription Edition 16.0.0 prior to build 16.0.20326.20190. |
| Impact | This is a low-severity, low-priority issue despite being a network-reachable flaw in a widely deployed product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, base 4.6) shows network attack vector with low complexity, but exploitation requires both existing privileges (PR:L - an authenticated SharePoint user) and victim user interaction (UI:R), with only low confidentiality and integrity impact and no availability impact. These limiting factors are reinforced by CISA's SSVC assessment: Exploitation=none, Automatable=no, Technical Impact=partial - all pointing to a non-urgent patch. No EPSS score was provided in the input, and there is no KEV listing and no public exploit identified, so there is no signal of real-world exploitation. The description's characterization as 'spoofing' is consistent with a stored/reflected XSS (CWE-79) used to manipulate what a victim sees rather than to fully take over the system, matching the Low C/I and A:N. No signals conflict: all sources converge on a genuinely low real-world risk. The main caveat is the missing EPSS value, which prevents a quantitative exploitation-probability cross-check. |
| Exploit ScenarioDerived | An authenticated low-privilege SharePoint user injects a malicious script into a page field that is improperly neutralized; when another SharePoint user views that content, the script executes in their browser session to spoof content or perform actions in their context. No public exploit code has been identified, and the attack requires the victim to interact with the crafted content. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Cross-site scripting in Microsoft SharePoint Server Subscription Edition (16.0.0 prior to build 16.0.20326.20190) lets an attacker holding a valid, low-privileged SharePoint account inject content that is rendered in another user's browser, enabling spoofing and manipulation of page content. Exploitation requires the victim to view or interact with the attacker-controlled content, and impact is limited to low confidentiality and integrity with no availability effect, consistent with the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, score 4.6). There is no public exploit identified at time of analysis and CISA's SSVC assessment records no exploitation and no automatable attack path, making this a low-severity, low-priority issue; a vendor patch is available.
RemediationAI
Apply the Microsoft update so the SharePoint Server Subscription Edition farm is running build 16.0.20326.20190 or later: this is the vendor-released patch identified in the affected-version data, delivered through the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88209 and distributed via Microsoft Update, the SharePoint product update channel, or the standalone installer, followed by running the SharePoint Products Configuration Wizard and verifying the build number after patching. Because the flaw requires a low-privileged authenticated account plus victim interaction, meaningful temporary mitigations include reducing the number of users with authoring or content-submission rights on sites where any authenticated user can post content (trade-off: limits collaboration and may require site-owner rework), tightening permissions so untrusted accounts cannot submit content into fields rendered to privileged users (trade-off: administrative overhead and possible workflow disruption), and deploying a content security policy or browser-side script restrictions on the farm (trade-off: CSP is difficult to tune in SharePoint and can break legitimate web parts). These compensating controls reduce exposure but do not eliminate the encoding defect, so the build-level update remains the primary fix; there is no vendor-released patch alternative to the cumulative update for this build line.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79, improper neutralization of input during web page generation, in the SharePoint web application's handling of user-supplied content that is later rendered as HTML to other users. An actor who controls a low-privilege authenticated account can place crafted markup into a field or page element that SharePoint does not correctly encode on output; when a victim loads that content, the injected script executes in the victim's browser session in the site's origin, which is the basis for the spoofing impact recorded in the CVSS vector (integrity and confidentiality both rated low, scope unchanged, availability unaffected). The vector PR:L explicitly confirms that authentication is required at a low privilege level, and UI:R confirms that no exploitation is possible without a victim visiting the affected page or otherwise interacting with the injected payload. The vulnerability is not remotely reachable by unauthenticated outsiders alone, nor does it allow code execution on the server, consistent with the partial technical impact in the SSVC assessment. Only SharePoint Server Subscription Edition is listed as affected, tracked under ENISA EUVD-2026-99740.
Know when Sharepoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Network-reachable XSS requiring an authenticated low-privileged account (PR:L) and victim interaction (UI:R); impact confined to the web app with low C/I and no availability effect.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Sharepoint
View allRemote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authen
SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted
Authenticated code injection in Microsoft SharePoint (CVSS 3.1 base 8.8) allows a remote attacker holding a valid low-pr
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190)
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.2
Authenticated path traversal in Microsoft SharePoint Server can be escalated to code execution over the network, allowin
Privilege escalation in Microsoft SharePoint Server Subscription Edition before build 16.0.20326.20190 allows a remote l
Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated remote attacker holding
Privilege elevation in Microsoft SharePoint Server Subscription Edition lets any attacker who already holds a valid low-
Privilege escalation in Microsoft SharePoint allows an authenticated low-privileged user to invoke functionality that la
Exploit-DB