EUVD-2026-44165
GHSA-vgmh-pfx7-6657
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-accessible XSS requiring authenticated low-privilege contributor access and victim page interaction; scope unchanged and no availability impact per spoofing-only characterization.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition enables an authenticated attacker with low-privilege network access to inject malicious scripts into SharePoint pages, resulting in spoofing impacts when a victim user interacts with the crafted content. The CVSS vector (PR:L/UI:R) confirms exploitation requires both an existing authenticated account and victim interaction, constraining real-world risk relative to unauthenticated XSS variants. No public exploit identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog. Vendor patch is available via the Microsoft Security Response Center.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient sanitization or encoding of attacker-controlled input before it is rendered in a browser. Microsoft SharePoint is a web-based collaboration and document management platform; user-generated content such as page text, list fields, or web parts is a classic injection surface for stored or reflected XSS. The CPE strings confirm three distinct product lines are affected: cpe:2.3:a:microsoft:microsoft_sharepoint_enterprise_server_2016, cpe:2.3:a:microsoft:microsoft_sharepoint_server_2019, and cpe:2.3:a:microsoft:microsoft_sharepoint_server_subscription_edition. The scope of impact (S:U) indicates the injected script executes within the SharePoint web origin, limiting cross-origin privilege escalation but still enabling session manipulation, credential harvesting, or UI spoofing within that origin.
RemediationAI
Patch available per vendor advisory - apply the Microsoft-released security update for the applicable SharePoint product line as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55020. Exact patched build numbers should be confirmed from the MSRC update guide, as they are not independently enumerated in the available intelligence data. Where immediate patching is not feasible, compensating controls include restricting SharePoint contribution rights to known-trusted users to reduce the attacker's ability to inject payloads (note: this limits collaboration functionality), enabling Content Security Policy headers via SharePoint or a WAF to restrict inline script execution (may break third-party web parts), and reviewing and hardening SharePoint HTML field rendering settings to enforce strict input filtering. These controls reduce but do not eliminate risk while a patch is pending.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today