EUVD-2026-99833
GHSA-x677-hvhp-vjwf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious XSS payload URL
-
ExploitLure authenticated SharePoint user to click
-
ExecutionScript executes in victim browser context
-
ImpactSpoof trusted UI and hijack session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the SharePoint web page generation path to render attacker-controlled input without proper neutralization (CWE-79), and critically requires victim user interaction (UI:R) - a user must click a crafted link or open attacker-influenced SharePoint content for the script to execute in their browser. While PR:N indicates no attacker authentication is needed to deliver the payload, realistic exploitation targets users who already have access to the affected SharePoint Server 2019 site, and success depends on that victim performing the triggering action. The mandatory user interaction and reliance on luring a specific victim are the primary limiting factors, which is why the flaw is assessed as non-automatable. |
| Impact | Signals are mixed and point to a moderate, not top-tier, priority. The CVSS 3.1 base score of 8.1 is driven by a network vector with low complexity and no privileges (AV:N/AC:L/PR:N), but exploitation is gated by required user interaction (UI:R), which materially lowers real-world attacker reliability. CISA's SSVC framework reinforces a lower urgency: Exploitation=none (no observed or public exploitation), Automatable=no (consistent with UI:R preventing worm-like mass exploitation), despite Technical Impact=total. There is no CISA KEV listing and no public POC identified, and no EPSS score was provided in the input, so exploitation-probability cannot be quantified. A notable internal tension exists: the description characterizes the outcome as 'spoofing,' yet the vendor CVSS vector claims high confidentiality AND high integrity impact (C:H/I:H) - these do not fully agree, as a spoofing-centric XSS would typically yield lower, browser-scoped impact; verify the true impact with Microsoft's advisory. Net: a credible but interaction-dependent XSS in an enterprise product - worth patching in normal cycles, not an emergency, absent evidence of active exploitation. |
| Exploit ScenarioDerived | An attacker crafts a malicious URL or SharePoint content payload containing script that is reflected or stored by the SharePoint web page generation logic. A victim with access to the SharePoint site is lured into clicking the link or viewing the content (UI:R), causing the script to execute in their browser session, enabling spoofing of trusted content and potential theft of session context. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Cross-site scripting (XSS) in Microsoft SharePoint Server 2019 allows remote attackers to inject malicious scripts into web pages viewed by other users, potentially leading to spoofing or limited data theft. Exploitation requires user interaction (e.g., clicking a crafted link) but no authentication, and it is not automatable. No public exploit code or active exploitation has been identified, and the overall risk is assessed as moderate due to the required victim interaction and limited impact.
RemediationAI
Apply the vendor-supplied security update referenced in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97783 as soon as it is released; no exact fix version was provided in the input data. Until a patch is available, enforce strict input validation and output encoding on all custom SharePoint components and web parts to prevent script injection. Consider deploying a web application firewall (WAF) with XSS filtering rules, though this may cause false positives and can be bypassed. Additionally, restrict the ability of untrusted users to create or edit content on the SharePoint site, accepting the trade-off of reduced collaboration functionality, and educate users to avoid clicking suspicious links within SharePoint.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic cross-site scripting (XSS) flaw (CWE-79) arising from improper neutralization of user-supplied input during web page generation in Microsoft SharePoint Server 2019. An attacker can craft a malicious URL or inject script into SharePoint content that, when rendered by the application, executes in the context of a victim user's browser. The assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates network exploitable, low attack complexity, no privileges required, but requires user interaction with a changed scope and low confidentiality and integrity impact. The SSVC decision framework rates exploitation as none and automatable as no, reflecting the need to lure a specific victim. SharePoint's web page generation path must be manipulated to deliver the payload, typically through reflected XSS or persistent XSS in user-editable fields. The flaw affects SharePoint Server 2019 per EUVD.
Know when Sharepoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network reflected XSS needs no privileges but requires victim interaction (UI:R); it executes across a security boundary into the browser (S:C) with spoofing-level low confidentiality/integrity impact, no availability effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Executive ViewAI
Microsoft SharePoint Server 2019 carries a high-severity cross-site scripting flaw (CVSS 8.1) that lets an attacker inject scripts into pages served to other users, enabling content spoofing and limited theft of information those users can already reach. Exploitation depends on a victim clicking a crafted link, and there is no public exploit identified at time of analysis, so the practical exposure is bounded but persistent for any group using SharePoint as an internal collaboration and document-sharing hub. Leadership should care because the affected population is broad and ordinary, the platform typically holds sensitive business content, and no vendor fix is currently available to close the gap.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict or monitor untrusted inbound links reaching SharePoint users; enforce content security and input-sanitization controls at the web front end where supported; limit anonymous or broad-access sharing sites to reduce the pool of pages an injected script could reach; increase logging and alerting on suspicious script injection in SharePoint responses; and segment high-value document libraries so a successful spoofing or limited data-theft attempt has a bounded blast radius. Apply the vendor fix immediately once released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Sharepoint
View allRemote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authen
SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted
Authenticated code injection in Microsoft SharePoint (CVSS 3.1 base 8.8) allows a remote attacker holding a valid low-pr
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190)
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.2
Authenticated path traversal in Microsoft SharePoint Server can be escalated to code execution over the network, allowin
Privilege escalation in Microsoft SharePoint Server Subscription Edition before build 16.0.20326.20190 allows a remote l
Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated remote attacker holding
Privilege elevation in Microsoft SharePoint Server Subscription Edition lets any attacker who already holds a valid low-
Privilege escalation in Microsoft SharePoint allows an authenticated low-privileged user to invoke functionality that la
Exploit-DB