What is the CVSS score of EUVD-2026-35544?

EUVD-2026-35544 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-35544?

Yes, a patch is available for EUVD-2026-35544. Update the affected software to the latest version immediately.

Microsoft SharePoint EUVD-2026-35544

| CVE-2026-45464 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 secure@microsoft.com

GHSA-q4j2-h6ph-3gjq

XSS Microsoft Sharepoint Server

5.4

CVSS 3.1 · NVD

Temporal: 4.7

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

4.7 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:46 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

MEDIUM 5.4

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

AnalysisAI

Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) enables a network-based attacker to perform spoofing by injecting malicious script into web page generation, affecting the confidentiality and integrity of victim sessions. The attack requires user interaction - a victim must click or load attacker-controlled content - which limits opportunistic exploitation but makes it viable via phishing or social engineering. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis; however, vendor-released patches are confirmed across all three affected release lines.

Technical ContextAI

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a stored or reflected XSS condition in SharePoint's web rendering pipeline where user-controlled input is echoed into HTML output without adequate sanitization or encoding. SharePoint's rich collaboration surface - including pages, web parts, and user-generated content - provides numerous input vectors where such defects can manifest. Three distinct SKUs are confirmed affected per EUVD-2026-35544: Microsoft SharePoint Enterprise Server 2016 (all 16.0.x builds prior to 16.0.5556.1005), SharePoint Server 2019 (all 16.0.x builds prior to 16.0.10417.20153), and SharePoint Server Subscription Edition (all 16.0.x builds prior to 16.0.19725.20384). All three share the same major version branch (16.0), suggesting the vulnerable code path is common across these release lines.

RemediationAI

Vendor-released patches are confirmed for all three affected product lines. Administrators should upgrade Microsoft SharePoint Enterprise Server 2016 to build 16.0.5556.1005 or later, SharePoint Server 2019 to build 16.0.10417.20153 or later, and SharePoint Server Subscription Edition to build 16.0.19725.20384 or later. Patch guidance and download links are available through the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45464. If immediate patching is not feasible, compensating controls should include enforcing strict Content Security Policy (CSP) headers on SharePoint responses to limit script execution scope, restricting the ability of non-administrative users to create or modify web pages and web parts, and enabling SharePoint's built-in HTML field security settings to reduce accepted markup. Note that CSP-based controls may break legitimate SharePoint customizations and should be tested in non-production environments before deployment. User-facing phishing awareness is also relevant given the UI:R attack vector.