EUVD-2026-56703
GHSA-f6rm-3j6f-3r58
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-accessible stored XSS requiring low-privileged authenticated contributor access and active victim interaction, with scope change to victim browser context; no availability impact applies to this class of injection.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft SharePoint Server allows an authenticated attacker to inject malicious script content that executes within other users' browser sessions, enabling spoofing and potential session compromise. Affected are SharePoint Server Subscription Edition, 2019, and 2016 Enterprise editions running builds below the July 2026 cumulative update thresholds. Exploitation requires contributor-level authenticated access and victim interaction; no active exploitation is confirmed and no public exploit code has been identified at time of analysis, though the CVSS scope change confirms that successful injection reaches beyond the SharePoint application boundary into victims' browser contexts.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize or encode user-supplied data before rendering it in a browser, allowing script injection. The affected products - cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*, cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*, and cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:* - are enterprise collaboration and document-management platforms that render rich HTML contributed by authenticated users. The CVSS scope change (S:C) confirms that injected script crosses the SharePoint application boundary to execute within the victim's browser security context, enabling session token theft, credential phishing overlays, or UI spoofing against the authenticated victim - capabilities beyond what a same-scope injection would permit.
RemediationAI
Apply the vendor-released cumulative updates that resolve this vulnerability: SharePoint Server Subscription Edition must be updated to build 16.0.19725.20522 or later; SharePoint Server 2019 must be updated to build 16.0.10417.20198 or later; SharePoint Enterprise Server 2016 must be updated to build 16.0.5565.1001 or later. Download links and installation guidance are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64902. If immediate patching is not feasible, compensating controls include restricting contributor-level write permissions on sensitive site collections to reduce the population of users who can inject content - note this does not eliminate the underlying flaw and introduces workflow friction. Enabling Microsoft Defender for Office 365 Safe Links can reduce the effectiveness of XSS-delivered phishing redirects but does not block the injection itself. Auditing and trimming over-privileged accounts reduces the attacker pool size. None of these mitigations substitute for the vendor patch.
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Ap
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today