What is the CVSS score of EUVD-2026-35654?

EUVD-2026-35654 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-35654?

Yes, a patch is available for EUVD-2026-35654. Update the affected software to the latest version immediately.

SharePoint Server EUVD-2026-35654

| CVE-2026-45483 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 secure@microsoft.com

GHSA-qwwr-fhfq-mfr4

XSS Microsoft Sharepoint Server

5.4

CVSS 3.1 · NVD

Temporal: 4.0

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

4.0 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jun 18, 2026 - 03:38 NVD

4.6 (MEDIUM) 5.4 (MEDIUM)

Analysis Generated

Jun 09, 2026 - 19:44 vuln.today

Patch available

Jun 09, 2026 - 19:03 EUVD

CVE Published

Jun 09, 2026 - 17:17 nvd

MEDIUM 4.6

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Project Server allows an authorized attacker to perform spoofing over a network.

AnalysisAI

Stored or reflected cross-site scripting in Microsoft SharePoint Server (the platform underlying Office Project Server) enables an authenticated low-privileged attacker to inject malicious script into web-rendered content, facilitating spoofing attacks against other users. The CVSS vector (PR:L/UI:R) confirms exploitation requires an authenticated account and victim interaction, constraining opportunistic use. No public exploit code has been identified at time of analysis, a vendor patch has been released, and no CISA KEV listing is present.

Technical ContextAI

CWE-79 (Improper Neutralization of Special Elements used in an Output Web Page - Cross-Site Scripting) describes the root cause: user-controlled input is rendered into a web page without adequate sanitization or output encoding, allowing injection of arbitrary client-side script. Microsoft Project Server is architecturally deployed on top of SharePoint Server, meaning vulnerabilities in the shared web-rendering layer affect both products. The EUVD data (EUVD-2026-35654) identifies three distinct SharePoint Server product lines as affected: SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, all sharing the 16.0.x version lineage. The CVSS vector AV:N/AC:L confirms the injection surface is network-reachable via standard HTTP/S requests, while S:U (Unchanged scope) limits the impact to the application's own security context rather than allowing host-level escape.

RemediationAI

Apply the vendor-released patches identified in EUVD-2026-35654. Upgrade SharePoint Enterprise Server 2016 to version 16.0.5556.1005 or later; upgrade SharePoint Server 2019 to version 16.0.10417.20153 or later; upgrade SharePoint Server Subscription Edition to version 16.0.19725.20384 or later. The authoritative patching guidance is published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45483. As a compensating control prior to patching, organizations can restrict low-privileged user permissions to create or modify content in SharePoint sites and Project Server project workspaces - this reduces injection surface but may impair legitimate collaboration workflows. Additionally, enforcing Content Security Policy (CSP) headers at the reverse proxy or WAF layer can reduce script execution impact, though SharePoint's complex page rendering may require careful tuning to avoid breaking functionality. Do not rely on compensating controls as a long-term substitute for the vendor patch.