EUVD-2026-56425
GHSA-6jm6-j28j-pj6p
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-accessible XSS requiring authenticated low-privileged contributor access and active victim interaction; scope unchanged to SharePoint origin; no availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) enables an authenticated, low-privileged attacker to inject malicious script content that renders in a victim's browser upon interaction with a crafted page, enabling spoofing and potential session compromise. All three actively-supported on-premises SharePoint product lines are affected, with patched builds available via Microsoft's Security Response Center advisory. No public exploit code and no CISA KEV listing exist at time of analysis, placing this in the routine patching tier rather than an emergency-response scenario.
Technical ContextAI
CWE-79 (Improper Neutralization of Special Elements used in a Web Page - Cross-Site Scripting) is the root cause: user-controllable input is incorporated into dynamically generated HTML without adequate sanitization or output encoding before being returned to the browser. In SharePoint's on-premises rendering pipeline, a server-side component fails to escape attacker-supplied content, allowing script injection. The CVSS S:U (Scope: Unchanged) metric confirms the injected script executes within the SharePoint web origin only, ruling out cross-origin data theft from unrelated applications. Three distinct on-premises CPE product lines are affected: SharePoint Enterprise Server 2016 (< 16.0.5565.1001), SharePoint Server 2019 (< 16.0.10417.20198), and SharePoint Server Subscription Edition (< 16.0.19725.20522), all sharing the 16.0.x version lineage.
RemediationAI
The definitive fix is to apply Microsoft's cumulative updates: upgrade SharePoint Enterprise Server 2016 to build 16.0.5565.1001 or later, SharePoint Server 2019 to build 16.0.10417.20198 or later, and SharePoint Server Subscription Edition to build 16.0.19725.20522 or later, all available via the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64922. If patching cannot be applied immediately, restrict page-editing and content-contribution permissions to the minimum necessary set of trusted users, reducing the pool of accounts capable of injecting malicious content; note this does not eliminate the risk if any contributor account is compromised. Enabling content inspection and safe-link scanning (e.g., Microsoft Defender for Office 365) can reduce the likelihood of victims loading attacker-crafted links but does not address the underlying injection flaw. Patching remains the only complete remediation.
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Ap
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today