EUVD-2026-56718
GHSA-6vgj-387w-6mj7
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Low-privilege authentication and active victim interaction are required; confidentiality and integrity impact is limited to SharePoint session context with no scope change or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition enables an authenticated low-privilege attacker to inject malicious script that, when rendered by a victim's browser, performs network-based spoofing within the SharePoint web application. All three current on-premises SharePoint product lines are affected across the 16.0.x branch, with specific fixed builds identified by EUVD-2026-56718. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released patches for all affected versions.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize user-supplied input before it is included in dynamic HTML output. SharePoint generates rich collaborative web pages from contributor-supplied content, and insufficient neutralization of that input allows script payloads to be embedded and later executed in other users' browser sessions. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N is consistent with a reflected or stored XSS pattern in a page-rendering component: network-reachable, low complexity, requiring a low-privilege authenticated account and active victim interaction, with no scope change beyond the SharePoint application itself. Affected product lines are all in the 16.0.x branch: SharePoint Enterprise Server 2016 (pre-16.0.5565.1001), SharePoint Server 2019 (pre-16.0.10417.20198), and SharePoint Server Subscription Edition (pre-16.0.19725.20522).
RemediationAI
Patch available per vendor advisory. Administrators should upgrade to the Microsoft-released fixed builds: SharePoint Enterprise Server 2016 to version 16.0.5565.1001 or later, SharePoint Server 2019 to version 16.0.10417.20198 or later, and SharePoint Server Subscription Edition to version 16.0.19725.20522 or later. Download and installation instructions are available through the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64916. Where immediate patching is operationally infeasible, organizations can reduce attacker surface by restricting contributor-level permissions on SharePoint site collections to the minimum required set of trusted users - this trade-off limits collaborative editing workflows but removes the low-privilege account prerequisite required for exploitation. Deploying a Web Application Firewall or reverse proxy configured with a strict Content Security Policy can reduce XSS exploitability but is not a substitute for the vendor patch and may require tuning to avoid breaking SharePoint functionality.
More in Sharepoint Server
View allMicrosoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over
Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated at
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a networ
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attac
Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Off
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 20
Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Ap
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today