EUVD-2026-56700
GHSA-7mj3-pc67-p4w8
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Low-privilege authentication required to inject content; victim interaction mandatory; scope change reflects script execution in victim browser; no availability impact on SharePoint server.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft SharePoint Server enables an authenticated attacker with low privileges to inject malicious scripts into web-rendered content, executing arbitrary JavaScript in victims' browsers and enabling spoofing attacks over the network. All three actively-supported SharePoint Server product lines are affected: Enterprise 2016, 2019, and Subscription Edition - making this a broad enterprise exposure. SSVC rates exploitation as none and not automatable, and no public exploit has been identified at time of analysis, though the scope change (S:C) and low attack complexity elevate theoretical impact beyond the 5.4 CVSS score suggests.
Technical ContextAI
CWE-79 (Improper Neutralization of Special Elements Used in a Web Page) describes a failure to sanitize user-supplied input before rendering it in a browser context. In SharePoint Server's case, this manifests in the server-side page generation layer where attacker-controlled content is reflected or stored and subsequently rendered without adequate encoding. The CVSS scope change metric (S:C) confirms that injected scripts execute outside SharePoint's own origin boundary - in the victim's browser context - allowing access to cookies, session tokens, and DOM data belonging to that browser session. Affected CPEs span cpe:2.3:a:microsoft:sharepoint_server with variants for enterprise (2016), standard (2019), and subscription editions, all sharing the 16.0.x version lineage and all below their respective patch thresholds per EUVD-2026-56700.
RemediationAI
Apply vendor-released patches for the respective product line: SharePoint Enterprise Server 2016 should be updated to 16.0.5565.1001 or later; SharePoint Server 2019 should be updated to 16.0.10417.20198 or later; SharePoint Server Subscription Edition should be updated to 16.0.19725.20522 or later. Patch versions are confirmed by ENISA EUVD-2026-56700 and the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64897. Where immediate patching is not possible, restrict SharePoint content editing permissions to the minimum necessary user set to reduce the attacker's ability to inject malicious content - note this limits collaboration functionality. Additionally, enforcing Content Security Policy headers at the reverse proxy or WAF layer can reduce XSS exploitability as a compensating control, though this does not eliminate the underlying vulnerability.
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Ap
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today