Microsoft SharePoint EUVD-2026-99047

Exploitation requires the attacker to be an authenticated, authorized SharePoint user (PR:L) able to submit content that SharePoint renders into a web page without proper neutralization, and it additionally requires a victim user to view the attacker-controlled content (UI:R) for the injected script to execute. These two factors - valid authentication to the SharePoint instance plus required victim interaction - are the primary limiters on exploitation. Affected scope per EUVD is Microsoft SharePoint Server Subscription Edition 16.0.0 before 16.0.20326.20190; patched builds are not exploitable. Impact is constrained to Low confidentiality and Low integrity (spoofing) with no availability impact, and the unchanged scope (S:U) indicates the effect stays within the vulnerable component's security authority.

This is a moderate-severity (CVSS 4.6) cross-site scripting (CWE-79) spoofing issue in Microsoft SharePoint Server Subscription Edition. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) is internally consistent and points to realistically limited risk: although the attack vector is network-based with low complexity, it requires BOTH prior authentication (PR:L - an authorized SharePoint user) AND victim user interaction (UI:R), with only Low confidentiality and Low integrity impact and no availability impact. No EPSS score, SSVC decision data, KEV listing, or POC was provided in the input. Exploitation status is therefore: no public exploit identified at time of analysis, and this CVE is not present in CISA KEV. The combination of required authentication, required user interaction, and low technical impact means this is a genuine but low-priority issue rather than an urgent one - it should be remediated via normal patch cycles, prioritized higher in environments where many semi-trusted users can author SharePoint content. No conflicting signals were found between the CVSS vector and the description (both indicate network-reachable, authorized-attacker exploitation).

An authenticated SharePoint user with content-authoring privileges injects a malicious script payload into a field or page that is improperly neutralized during web page generation. When another user views the crafted content, the script executes in their browser session, enabling spoofing of trusted UI or content. No public exploit code was identified in the provided data, and both authentication and victim interaction are required.