Microsoft SharePoint EUVD-2026-44175

Exploitation requires the attacker to already hold a low-privileged but authenticated SharePoint account (PR:L) with the ability to submit content that is rendered to other users, and it requires a victim to view that attacker-controlled content (UI:R) - so a stored/reflected XSS pathway into a shared page, list, or web part is the concrete prerequisite. Limiting factors that reduce real-world risk: the attacker cannot be fully anonymous (needs valid credentials or an account on the SharePoint farm), a separate victim must interact by loading the crafted content, and only the listed on-premises SharePoint builds below the patched versions are affected - SharePoint Online is not named in the provided data. The scope change (S:C) means successful injection can affect resources beyond the attacker's own context.

Signals are largely aligned toward a real but conditional risk rather than an emergency. CVSS 3.1 is 8.7 (High) driven by network vector, low complexity, scope change, and high confidentiality/integrity impact, but it also requires low privileges (PR:L) and user interaction (UI:R), which meaningfully constrain mass exploitation. CISA's SSVC framework reinforces this: Exploitation is 'none' (no known active or public exploitation), Automatable is 'no' (the required authentication plus victim interaction prevents reliable large-scale automation), while Technical Impact is 'total'. There is no EPSS score provided and no CISA KEV listing, so this is not confirmed actively exploited; the balance of evidence points to a high-severity issue that is a strong patch priority in SharePoint-heavy environments but not a drop-everything internet-worm scenario. Note one point to verify: the CVSS labels impact as C:H/I:H yet the described effect is 'spoofing', so confirm with Microsoft's advisory whether confidentiality/integrity loss (e.g., session/content theft) matches your threat model.

An attacker with a normal SharePoint contributor account stores a malicious script payload in a page, list item, or web-part field on a site that other users routinely visit. When a higher-privileged colleague opens that content, the script executes in their authenticated SharePoint session, letting the attacker impersonate (spoof) them and act on their data. No public exploit code is identified at this time, and the required authentication plus user interaction keep the attack targeted rather than automated.