EUVD-2026-35578
GHSA-r9mh-796v-4gxx
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft SharePoint allows an authenticated network attacker to inject malicious scripts into SharePoint-generated web pages, enabling spoofing attacks against other authenticated users. Affected products span three active SharePoint server product lines - Enterprise Server 2016, Server 2019, and Subscription Edition - all sharing the 16.0.x codebase, with vendor-released patches now available per MSRC. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), indicating that SharePoint's web rendering layer fails to adequately sanitize attacker-supplied input before embedding it in HTML output delivered to other users' browsers. Microsoft SharePoint is an enterprise collaboration platform built on ASP.NET, providing document management, intranet portals, and list-based data sharing. All three affected product lines - SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition - share the version 16.0.x code base, per EUVD-2026-35578 CPE-aligned version data. The XSS condition allows injected script content to execute within the SharePoint web origin in a victim's browser, enabling session context abuse within that origin.
RemediationAI
Apply the vendor-released patches published by Microsoft Security Response Center. The fixed versions are: SharePoint Enterprise Server 2016 build 16.0.5556.1005 or later, SharePoint Server 2019 build 16.0.10417.20153 or later, and SharePoint Server Subscription Edition build 16.0.19725.20384 or later. Patch details and download links are available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47640. If immediate patching is not operationally feasible, reduce attack surface by restricting SharePoint content-creation and editing permissions to the minimum necessary set of users, since exploitation requires an authenticated contributor-level account - note that tightening permissions may impair normal collaboration workflows. If your SharePoint deployment supports custom HTTP response headers, enforcing a restrictive Content-Security-Policy can limit the runtime impact of injected scripts by constraining script execution origins, though this is a defense-in-depth measure and not a substitute for patching.
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Ap
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today