EUVD-2026-56292
GHSA-g98p-8265-rp44
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Authenticated low-privilege attacker (PR:L) injects script; victim interaction required (UI:R); scope changes to victim browser (S:C); no availability impact for XSS spoofing.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft SharePoint Server allows an authenticated network attacker to perform spoofing attacks against users by injecting malicious script content into web pages served by the platform. Affected deployments include SharePoint Server Subscription Edition prior to build 16.0.19725.20522 and SharePoint Server 2019 prior to build 16.0.10417.20198. Exploitation requires victim interaction (UI:R) and attacker authentication (PR:L), and no public exploit code or active exploitation has been identified at time of analysis per SSVC data.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize user-controlled input before it is rendered in HTML context, allowing injected JavaScript or HTML to execute in a victim's browser session. The CVSS scope indicator S:C confirms the vulnerability crosses a security boundary - injected script executing in the victim's browser can access the SharePoint session context and potentially other browser-accessible resources. The affected components are identified by CPE as cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:* and cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*, covering both the Subscription Edition and the 2019 on-premises release lines. SharePoint's collaborative content model - where authorized users can contribute pages, lists, or web parts - creates natural injection surfaces if input is not properly encoded on output.
RemediationAI
Patch available per vendor advisory: upgrade SharePoint Server Subscription Edition to build 16.0.19725.20522 or later, and SharePoint Server 2019 to build 16.0.10417.20198 or later, as confirmed by EUVD-2026-56292. Apply the relevant Cumulative Update or Security Update from Microsoft's Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62829. If patching cannot be applied immediately, restrict the ability of low-privileged users to create or edit pages and web parts - note this may disrupt collaboration workflows. Additionally, enabling Content Security Policy (CSP) headers at the reverse proxy or WAF layer to restrict script execution origins can reduce XSS blast radius, though SharePoint's rich client-side functionality may require careful CSP tuning to avoid breaking features. Review SharePoint site permissions and apply least-privilege principles to limit which users can contribute injectable content.
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Ap
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today