EUVD-2026-45063
GHSA-xpgg-r72x-rgc7
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
PR:L because a valid SharePoint account is required; UI:R because victim must render injected content; S:U and C:L/I:L as impact is application-scoped with no availability effect.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Stored or reflected cross-site scripting in Microsoft SharePoint Server allows an authenticated low-privileged attacker to inject malicious script content that executes in a victim's browser, enabling spoofing attacks over a network. Affected deployments span SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated attacker holding at minimum a low-privilege SharePoint account (CVSS PR:L) - unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.6 Medium score is consistent with the actual threat model here: PR:L mandates an existing authenticated SharePoint account, and UI:R requires a victim to actively visit or render the malicious content - both factors meaningfully reduce opportunistic exploitation compared to unauthenticated or interaction-free XSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privilege SharePoint account (e.g., a standard organizational user or a compromised account) injects malicious JavaScript into a SharePoint list field, page description, or web part that accepts user-controlled HTML input. When a higher-privileged user or administrator navigates to that page, the injected script executes in their browser session, allowing the attacker to perform spoofing actions - such as rendering a fake login prompt, exfiltrating the victim's SharePoint session token, or silently modifying visible page content - without any elevated SharePoint permissions of their own. |
| Remediation | Patch available per vendor advisory - apply the Microsoft-released security update for the relevant SharePoint server version (2016, 2019, or Subscription Edition) via the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62826. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today