EUVD-2026-44159
GHSA-f6f5-mgpp-vqcw
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Authenticated contribution access (PR:L) and mandatory victim page visit (UI:R) required; scope changes as exploit executes in victim browser (S:C); no availability impact applies.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, Server 2019, and Server Subscription Edition enables an authenticated attacker to inject malicious scripts into SharePoint-generated web pages viewed by other users, producing a spoofing effect. The scope-changed CVSS vector (S:C) confirms that impact escapes the server component and reaches victim browsers. No active exploitation is confirmed - EPSS sits at 0.28% (20th percentile) and CISA has not added this to KEV - placing real-world urgency below the raw CVSS 5.4 might suggest.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to encode or sanitize attacker-controlled data before it is embedded in HTML output. In SharePoint's case, the collaborative content platform trusts certain authenticated user input during page rendering, allowing script tags or event handlers to survive into the DOM. The CVSS scope change (S:C) is technically significant: although the vulnerability resides in SharePoint's server-side rendering, the exploitable impact materialises in the victim's browser - a different security authority - enabling session token theft, credential harvesting via spoofed UI, or forced redirects. Affected CPE strings confirm three distinct product lines: cpe:2.3:a:microsoft:microsoft_sharepoint_enterprise_server_2016, cpe:2.3:a:microsoft:microsoft_sharepoint_server_2019, and cpe:2.3:a:microsoft:microsoft_sharepoint_server_subscription_edition.
RemediationAI
Apply the vendor-released patches that bring each affected product above the fixed build thresholds: SharePoint Enterprise Server 2016 must reach 16.0.5561.1001 or later, SharePoint Server 2019 must reach 16.0.10417.20175 or later, and SharePoint Server Subscription Edition must reach 16.0.19725.20434 or later. Detailed installation instructions are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55016. Where immediate patching is not feasible, restrict SharePoint contribution permissions to the smallest required set of trusted accounts to limit the authenticated attacker pool (PR:L prerequisite). Additionally, deploying a Web Application Firewall rule to strip or encode common XSS payloads in SharePoint-bound HTTP requests may reduce exposure, though this is not a substitute for patching and may interfere with legitimate rich-text content submission.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today