SharePoint Server EUVD-2026-99042

Exploitation requires the attacker to hold valid, authenticated access to the SharePoint site with privileges sufficient to insert content into a web page or field that is rendered to other users (PR:L). A separate victim user must then view or interact with the attacker-controlled page for the script to fire (UI:R) - the flaw cannot be triggered unattended. Only Microsoft SharePoint Server Subscription Edition 16.0.0 builds prior to 16.0.20326.20190 are affected; patched builds and other SharePoint editions are out of scope. These two gates (prior authentication plus victim interaction) materially reduce real-world risk below what the network attack vector alone suggests.

This is a genuinely low-priority issue despite being network-exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, base 4.6 MEDIUM) shows the attack is reachable over the network but gated by two meaningful barriers: the attacker must already hold SharePoint privileges (PR:L) and a victim must be lured into interacting with the malicious content (UI:R). Impact is limited to low confidentiality and low integrity with no availability loss, consistent with a spoofing/XSS outcome rather than code execution or data exfiltration at scale. No EPSS score, KEV listing, SSVC decision, or POC was provided in the input, so there is no signal of active exploitation or published exploit code - this should be treated as 'no public exploit identified at time of analysis.' The signals are internally consistent (no conflict between CVSS and description); the main caveat is the absence of EPSS/exploitation telemetry, which means prioritization rests on the CVSS profile alone. Bottom line: a legitimate but low-urgency patch-cycle item, not an emergency.

An authenticated SharePoint user with content-contribution rights injects a malicious script into a SharePoint page or field that is not properly neutralized. When another user views that page, the script executes in their browser session and is used to spoof trusted content or UI. No public exploit code was identified in the provided data, and the required victim interaction limits reliability.