Microsoft SharePoint EUVD-2026-56765

Exploitation requires victim user interaction (CVSS UI:R): the target must open or interact with attacker-supplied SharePoint content or a crafted link for the injected script to execute - it is not a zero-click bug. No authentication is required of the attacker (PR:N), and the vector is network-reachable (AV:N) with low complexity (AC:L), so any user able to submit content to, or send a link into, a reachable SharePoint instance can attempt it. The principal limiting factor is that a signed-in victim must be socially engineered into the interaction; the exact injection point/feature is not specified in the available data and should be confirmed against the MSRC advisory.

The signals are mixed and warrant a nuanced read rather than a raw 9.3-driven panic. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) shows a network, low-complexity, unauthenticated attack, but it critically requires user interaction (UI:R), which meaningfully lowers real-world exploitability compared with a zero-click bug - an attacker must lure a victim into opening or interacting with malicious content. The scope change (S:C) and C:H/I:H are on the aggressive side for an XSS whose stated impact is 'spoofing'; that impact wording implies deception/session-context abuse more than full data compromise, so Microsoft's high confidentiality/integrity ratings may overstate a purely spoofing-oriented issue - worth verifying against the MSRC advisory. There is no EPSS score, no KEV listing, and no public POC in the provided data, so exploitation is currently theoretical; that said, SharePoint's ubiquity in enterprises means a working exploit would have broad reach, and any organization running it - even a mid-sized municipal IT team in olsztyn should treat a critical SharePoint XSS as a priority to patch - should schedule the fix promptly rather than defer it. Overall: a legitimate high-priority patch item due to product prevalence and unauthenticated network vector, tempered by the user-interaction requirement and the absence of any active-exploitation or POC signal.

An attacker crafts a SharePoint URL or content item embedding a malicious script payload and delivers it to a target user (e.g., via email or a shared link). When the authenticated victim opens it, the script executes in their SharePoint session context and performs spoofing actions - such as presenting forged trusted content or acting under the victim's identity. No public POC is identified at time of analysis, and the low attack complexity means a reliable exploit would be straightforward to weaponize if the specific injection point is disclosed.