Sharepoint Server

Privilege escalation via stored cross-site scripting in Microsoft SharePoint Server allows an authenticated low-privileged attacker to elevate their rights over a network by injecting malicious script that executes in a victim's browser session. Affected products include SharePoint Server 2019 and Subscription Edition with specific unpatched builds. No active exploitation has been confirmed - SSVC rates exploitation as none, EPSS stands at 0.42% (35th percentile), and the CVE is not listed in CISA KEV - though the CVSS-rated technical impact is classified as total due to high confidentiality and integrity compromise enabled by the scope change.

Privilege escalation via SSRF in Microsoft Office SharePoint exposes authenticated users to full system compromise - confidentiality, integrity, and availability all rated High. The CVSS vector (PR:L/AV:N/AC:L/UI:N) confirms that any authenticated SharePoint user can trigger the vulnerability over the network without additional complexity. No active exploitation or public exploit code has been identified at time of analysis, though the low attack complexity and broad privilege impact make this a credible near-term risk.

Server-side request forgery in Microsoft Office SharePoint enables low-privileged authenticated attackers to escalate privileges with no user interaction required, achieving high confidentiality, integrity, and availability impact. The flaw (CWE-918) allows a legitimate but low-privilege account holder to forge server-side HTTP requests, likely reaching internal administrative interfaces or credential endpoints inaccessible from the network perimeter. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Remote code execution in Microsoft Office SharePoint allows an attacker authenticated with low privileges to execute arbitrary code over a network via unsafe deserialization of user-controlled data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms full confidentiality, integrity, and availability impact with no user interaction required. No public exploit code has been identified at time of analysis, and SharePoint is not currently listed in the CISA KEV catalog based on available data.

Cross-site scripting in Microsoft Office SharePoint lets a remote, unauthenticated attacker inject script that executes in a victim's browser session to conduct spoofing, provided the victim is lured into interacting with the malicious content. Microsoft rates it 9.3 (Critical) with a scope-changed vector, reflecting that injected script escapes into the victim's authenticated SharePoint context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in Microsoft Office SharePoint exploits unsafe deserialization of attacker-controlled data over the network. An authenticated attacker with low-level network access can submit a crafted serialized payload that SharePoint deserializes without sufficient validation, resulting in full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, but the low attack complexity and high impact across all three security properties make this a critical remediation priority.

Remote code execution in Microsoft Office SharePoint enables any authenticated low-privileged user to execute arbitrary code on the server by submitting maliciously crafted serialized data over the network. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack requires no user interaction, low complexity, and only a standard SharePoint account - making this straightforward to weaponize within any organization whose SharePoint is network-accessible to internal users or external authenticated parties. No public exploit code or CISA KEV listing is identified at time of analysis, though SharePoint deserialization vulnerabilities have historically attracted rapid weaponization.

Remote code execution in Microsoft SharePoint Server allows a network-authenticated attacker with low-level privileges to execute arbitrary code by exploiting unsafe deserialization of attacker-controlled data. Both SharePoint Server 2019 and the Subscription Edition are confirmed affected, with patches available from Microsoft. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and full-triad impact (C:H/I:H/A:H) make this a high-priority patching target for enterprise environments.

Remote code execution in Microsoft SharePoint allows any authenticated, low-privileged network attacker to execute arbitrary code on the server by exploiting unsafe deserialization of attacker-controlled data (CWE-502). Three on-premises SharePoint Server product lines are confirmed affected - Enterprise Server 2016, Server 2019, and Server Subscription Edition - with fixed builds available from Microsoft. No public exploit code has been identified at time of analysis, but the low attack complexity and precedent of prior SharePoint deserialization CVEs being rapidly weaponized (e.g., CVE-2019-0604) make this a high-priority patching target for any organization running on-premises SharePoint.

Code injection (CWE-94) in Microsoft SharePoint Server exposes authenticated network users to high-impact compromise across confidentiality, integrity, and availability on unpatched servers running SharePoint 2016 Enterprise, 2019, or Subscription Edition. The CVSS 8.8 rating (AV:N/AC:L/PR:L) reflects network exploitation requiring only low-privileged credentials, though the CVE description characterizes the primary effect as spoofing rather than full remote code execution - a tension that deserves verification against the Microsoft MSRC advisory. No public exploit code and no CISA KEV listing have been identified at time of analysis, and SSVC rates exploitation as none and automatable as no, moderating the immediate response urgency.

Remote code execution in Microsoft SharePoint Server exposes organizations to full system compromise via deserialization of attacker-controlled data submitted over the network. Versions across three SharePoint Server editions (Subscription Edition, 2019, and Enterprise 2016) are confirmed affected, all requiring only a low-privileged authenticated account to exploit. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and high impact across confidentiality, integrity, and availability make this a critical-priority remediation item for any enterprise SharePoint deployment.

Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) enables an authenticated, low-privileged attacker to inject malicious script content that renders in a victim's browser upon interaction with a crafted page, enabling spoofing and potential session compromise. All three actively-supported on-premises SharePoint product lines are affected, with patched builds available via Microsoft's Security Response Center advisory. No public exploit code and no CISA KEV listing exist at time of analysis, placing this in the routine patching tier rather than an emergency-response scenario.

Privilege escalation in Microsoft SharePoint Server (2016 Enterprise, 2019, and Subscription Edition) allows a low-privileged authenticated attacker to gain elevated access over the network by invoking a critical internal function that lacks proper authentication enforcement. The flaw (CWE-306) is exploitable with low complexity and no user interaction, resulting in full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity against a widely-deployed enterprise platform makes this a priority patching target.

Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition enables an authenticated low-privilege attacker to inject malicious script that, when rendered by a victim's browser, performs network-based spoofing within the SharePoint web application. All three current on-premises SharePoint product lines are affected across the 16.0.x branch, with specific fixed builds identified by EUVD-2026-56718. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released patches for all affected versions.

Cross-site scripting in Microsoft SharePoint Server allows an authenticated attacker to inject malicious script content that executes within other users' browser sessions, enabling spoofing and potential session compromise. Affected are SharePoint Server Subscription Edition, 2019, and 2016 Enterprise editions running builds below the July 2026 cumulative update thresholds. Exploitation requires contributor-level authenticated access and victim interaction; no active exploitation is confirmed and no public exploit code has been identified at time of analysis, though the CVSS scope change confirms that successful injection reaches beyond the SharePoint application boundary into victims' browser contexts.

Remote code execution in Microsoft SharePoint Server allows any authenticated network attacker to execute arbitrary code by submitting a malicious serialized object payload to vulnerable endpoints. Three major SharePoint versions are affected - SharePoint Server 2016, 2019, and Subscription Edition - all running build versions below their respective patched thresholds. No public exploit code has been identified at time of analysis, but the low privilege requirement (any valid SharePoint account) and low attack complexity make this a high organizational priority, particularly given SharePoint's widespread enterprise deployment footprint.

Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated, low-privilege attacker to inject malicious scripts that execute in other users' browsers upon interaction, enabling session hijacking and spoofing attacks within the SharePoint context. The CVSS 7.3 score reflects high confidentiality and integrity impact bounded to the SharePoint application scope, gated by both valid credentials and victim interaction. Microsoft has released patches for all three affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.

Cross-site scripting in Microsoft SharePoint Server enables an authenticated attacker with low privileges to inject malicious scripts into web-rendered content, executing arbitrary JavaScript in victims' browsers and enabling spoofing attacks over the network. All three actively-supported SharePoint Server product lines are affected: Enterprise 2016, 2019, and Subscription Edition - making this a broad enterprise exposure. SSVC rates exploitation as none and not automatable, and no public exploit has been identified at time of analysis, though the scope change (S:C) and low attack complexity elevate theoretical impact beyond the 5.4 CVSS score suggests.

Remote code execution in Microsoft SharePoint is achievable by unauthenticated network attackers exploiting improper input validation (CWE-20), with the 'Authentication Bypass' tag indicating the flaw may circumvent access controls entirely. Three active SharePoint product lines are confirmed affected - Enterprise Server 2016, Server 2019, and the Subscription Edition - across a defined version range for each. Vendor patches are available from Microsoft; no public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible, zero-privilege attack vector makes this a high-priority patching target.

Deserialization of untrusted data in Microsoft SharePoint Server exposes networks to spoofing attacks by authenticated low-privileged users. Confirmed affected versions span SharePoint Enterprise Server 2016, SharePoint Server 2019, and the Subscription Edition. The CVSS vector (PR:L, C:H, I:N) indicates an authenticated attacker can leverage unsafe deserialization to impersonate another identity or access confidential data, though no public exploit code or CISA KEV listing has been identified at time of analysis.

Remote code execution in Microsoft SharePoint Server affects authenticated network users through unsafe deserialization of attacker-controlled data. Affected versions span SharePoint Server 2019, SharePoint Enterprise Server 2016, and SharePoint Server Subscription Edition - all running build numbers below the patched releases issued by Microsoft. An attacker with a valid low-privilege account can send a crafted payload over the network to trigger arbitrary code execution on the server without any user interaction, achieving full compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing is identified at time of analysis, but the low-complexity, network-reachable attack surface makes this a high-priority patching target.

Incorrect authorization in Microsoft SharePoint Server exposes authenticated network attackers to unrestrained content tampering across three supported product lines. The flaw, rooted in CWE-863 (Incorrect Authorization), allows a low-privileged but authenticated user to perform write or modification operations that server-side access controls should restrict to higher-privileged roles. Microsoft has released patches for all three affected versions; no public exploit code or CISA KEV listing exists at time of analysis.

Spoofing in Microsoft SharePoint Server allows an authenticated low-privilege network attacker to manipulate content presentation or deceive users through improper input validation, achieving limited confidentiality and integrity impact. Affected deployments span SharePoint Server 2016 Enterprise, 2019, and Subscription Edition across a wide range of versions prior to their respective Microsoft-patched builds. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires both a low-privilege authenticated session and victim user interaction, constraining realistic threat scope.

Credential exposure in Microsoft SharePoint Server (CWE-522) enables an authenticated network attacker to intercept insufficiently protected credentials and perform identity spoofing against the affected deployment. All three active on-premises SharePoint release lines are confirmed affected - 2016 Enterprise, 2019, and Subscription Edition - with patched thresholds provided by EUVD. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a standard SharePoint user account, with high confidentiality impact; no active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis.

Relative path traversal in Microsoft SharePoint Server exposes arbitrary server-side files to any authenticated network user, with confirmed patches now available across all three affected product lines. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates any valid SharePoint account holder can exploit this with low complexity and no victim interaction, resulting in high confidentiality impact. No public exploit code exists at time of analysis and CISA SSVC rates current exploitation as none, though the broad deployment footprint and accessible attack bar warrant prompt patching.

Cross-site scripting in Microsoft SharePoint Server allows an authenticated network attacker to perform spoofing attacks against users by injecting malicious script content into web pages served by the platform. Affected deployments include SharePoint Server Subscription Edition prior to build 16.0.19725.20522 and SharePoint Server 2019 prior to build 16.0.10417.20198. Exploitation requires victim interaction (UI:R) and attacker authentication (PR:L), and no public exploit code or active exploitation has been identified at time of analysis per SSVC data.

Privilege escalation in Microsoft SharePoint allows an authenticated low-privilege attacker to elevate to higher permissions over a network, exploiting improper authentication logic (CWE-287). Three on-premises SharePoint versions are confirmed affected - Enterprise Server 2016, Server 2019, and the current Subscription Edition - with vendor-released patches available for all. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 score and full High C/I/A impact profile make this a serious priority for organizations running unpatched on-premises SharePoint.

Server-Side Request Forgery in Microsoft SharePoint Server 2016, 2019, and Subscription Edition enables authenticated network-adjacent attackers to coerce the SharePoint server into issuing outbound HTTP requests to attacker-controlled or internal network destinations, resulting in high-confidentiality-impact spoofing. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms exploitation is low-complexity, requires only a standard SharePoint account, and yields significant information disclosure with no integrity or availability loss. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Cross-site scripting in Microsoft SharePoint Server enables an authenticated low-privilege attacker to inject malicious scripts into SharePoint content that execute in a victim user's browser, enabling session token theft, credential harvesting, or on-behalf-of actions under the victim's identity. Affected products are SharePoint Server Subscription Edition prior to 16.0.19725.20522 and SharePoint Server 2019 prior to 16.0.10417.20198. Vendor-released patches are available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.

Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) enables an authenticated attacker with low-level network access to inject malicious scripts into SharePoint-generated web pages, resulting in spoofing attacks against other users. The vulnerability requires victim interaction to trigger script execution, limiting automated exploitation. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; the CVSS score of 4.6 reflects the constrained impact and authentication prerequisite.

Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) enables low-privileged authenticated attackers to perform spoofing attacks over a network without requiring user interaction. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-reachable exploitation by any authenticated SharePoint user with no further interaction required from a victim. No public exploit identified at time of analysis and CISA SSVC classifies exploitation status as none, though vendor patches are available for all three affected product lines.

Cross-site scripting in Microsoft SharePoint allows an authenticated network attacker with low privileges to inject malicious script content into web pages, enabling spoofing attacks against other users. All three active SharePoint server product lines - Server 2019, Enterprise Server 2016, and Subscription Edition - are affected across broad version ranges. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; vendor-released patches are available for all affected product lines.

Cross-site scripting in Microsoft SharePoint allows an authenticated network attacker to inject malicious scripts into SharePoint-generated web pages, enabling spoofing attacks against other authenticated users. Affected products span three active SharePoint server product lines - Enterprise Server 2016, Server 2019, and Subscription Edition - all sharing the 16.0.x codebase, with vendor-released patches now available per MSRC. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Cross-site scripting in Microsoft SharePoint Server enables network-based spoofing attacks by injecting malicious scripts into rendered web pages, requiring victim user interaction to trigger. Three SharePoint server product lines are affected across the 16.0.x code branch, with vendor-released patches available for all. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Cross-site scripting in Microsoft SharePoint allows an authenticated low-privilege network attacker to inject malicious script content into SharePoint pages, enabling spoofing attacks against victim users who render the affected content. Three product lines are affected: SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, all at specific 16.0.x build levels. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.6 Medium score reflects meaningful risk reduction from the dual prerequisites of authenticated access and required victim interaction.

Cross-site scripting in Microsoft SharePoint Server (Subscription Edition, 2019, and 2016) enables an authenticated low-privileged attacker to inject malicious scripts into web pages served to other users, resulting in spoofing over the network. The CVSS vector (PR:L/UI:R/S:U) confirms exploitation requires valid credentials and victim interaction, constraining the attack surface to authenticated SharePoint environments where a user can be induced to visit attacker-controlled content. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) enables network-based spoofing attacks against authenticated users who interact with attacker-controlled content. The vulnerability stems from insufficient input neutralization during web page generation (CWE-79), allowing injected script to execute in a victim's browser context. No public exploit code has been identified at time of analysis, and a vendor-released patch is available via Microsoft's Security Response Center.

Stored or reflected cross-site scripting in Microsoft Office SharePoint allows an authenticated attacker with low privileges to inject malicious script that, after victim interaction, results in spoofing and disclosure or alteration of sensitive content within a victim's browser session. The CVSS 7.3 (AV:N/AC:L/PR:L/UI:R) rating reflects network-reachable exploitation with low complexity but requires both a valid SharePoint account and user interaction. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Remote code execution in Microsoft Office SharePoint enables an authenticated attacker with low privileges to execute arbitrary code over the network when a victim user is induced to perform an action. The flaw stems from an improper authorization check (CWE-285) that fails to enforce expected access boundaries, yielding full confidentiality, integrity, and availability impact (CVSS 8.0). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Out-of-bounds read in Microsoft Office and SharePoint Server exposes low-level memory contents to a local attacker when a victim opens a crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office 2016/2019/LTSC 2021/2024, Office for Mac variants, and SharePoint Server 2016/2019/Subscription Edition - all at version 16.0.x baselines. The CVSS score of 3.3 (Low) reflects constrained impact: confidentiality is only partially affected, integrity and availability are untouched, and exploitation requires both local access and user interaction. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Privilege escalation in Microsoft Office SharePoint allows an authenticated network attacker to elevate privileges by submitting maliciously crafted serialized data that the server deserializes without proper validation. The CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability combined with low attack complexity, though the PR:L requirement means the attacker must already hold at least a low-privileged SharePoint account. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Stored or reflected cross-site scripting in Microsoft SharePoint Server (the platform underlying Office Project Server) enables an authenticated low-privileged attacker to inject malicious script into web-rendered content, facilitating spoofing attacks against other users. The CVSS vector (PR:L/UI:R) confirms exploitation requires an authenticated account and victim interaction, constraining opportunistic use. No public exploit code has been identified at time of analysis, a vendor patch has been released, and no CISA KEV listing is present.

Stored or reflected cross-site scripting in Microsoft Office SharePoint allows an authenticated low-privileged attacker to inject script that executes in another user's browser session, enabling spoofing and high-impact disclosure or modification of data rendered in the victim's context. The CVSS 7.3 vector requires user interaction and existing access to the SharePoint site, and no public exploit identified at time of analysis. The flaw is consistent with the CWE-79 class of input neutralization failures during web page generation.

Cross-site scripting in Microsoft SharePoint allows an authenticated network attacker to perform spoofing attacks by injecting malicious script into web page content. Affected products include SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition across all builds below their respective patched versions. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; the CVSS score of 4.6 reflects the mandatory user interaction and constrained confidentiality/integrity impact.

Local code execution in Microsoft Office is possible through a heap-based buffer overflow (CWE-122) that an unauthenticated attacker can trigger when a user opens a crafted document. The CVSS 3.1 base score of 7.8 reflects high impact to confidentiality, integrity, and availability, with required user interaction limiting mass exploitation. There is no public exploit identified at time of analysis and the issue is not currently listed on the CISA KEV catalog.

Local code execution in Microsoft Office Word enables an attacker to run arbitrary code in the context of the current user by tricking them into opening a malicious document that triggers an untrusted pointer dereference. With a CVSS 7.8 score and no public exploit identified at time of analysis, the flaw is exploited locally but unauthenticated, relying on user interaction to open a crafted file. Microsoft has issued an advisory via the MSRC Security Update Guide.

Cross-site scripting in Microsoft SharePoint Server allows an authenticated low-privileged attacker to inject malicious scripts into SharePoint-generated web pages, enabling spoofing attacks against other authenticated users over the network. Three product lines are confirmed affected: SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016, each with specific patched build thresholds. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all three product lines.

Stored or reflected cross-site scripting in Microsoft SharePoint on-premises deployments enables an authenticated attacker to perform spoofing attacks against other users over a network. Affected products span three major on-premises release lines: SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. The CVSS vector (PR:L, UI:R) confirms exploitation requires a low-privileged authenticated account and victim user interaction, meaningfully constraining opportunistic attack. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.

Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition enables network-based spoofing attacks by injecting malicious scripts into rendered web page output. The vulnerability carries a CVSS 5.4 (Medium) score with low attack complexity and no privilege requirement per the CVSS vector, but requires victim user interaction - a pattern consistent with reflected or stored XSS leading to in-browser script execution within a trusted SharePoint domain. No public exploit code or CISA KEV listing has been identified at time of analysis, though the broad enterprise deployment footprint of SharePoint elevates real-world relevance beyond the moderate CVSS score.

Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) enables a network-based attacker to perform spoofing by injecting malicious script into web page generation, affecting the confidentiality and integrity of victim sessions. The attack requires user interaction - a victim must click or load attacker-controlled content - which limits opportunistic exploitation but makes it viable via phishing or social engineering. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis; however, vendor-released patches are confirmed across all three affected release lines.

Stored or reflected cross-site scripting in Microsoft SharePoint Server enables an authenticated network attacker to perform spoofing attacks against other users by injecting malicious script into web page output. Affected products span three SharePoint Server product lines - 2016 Enterprise, 2019, and Subscription Edition - all on build version 16.0.x below their respective patched thresholds. Microsoft has released patches across all affected branches; no public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Local code execution in Microsoft Office via a type confusion flaw (CWE-416) permits unauthorized attackers to run arbitrary code in the context of the Office process without requiring privileges or user interaction. The issue carries a high CVSS 3.1 score of 8.4 with full impact across confidentiality, integrity, and availability, though exploitation requires local attack vector access to the target system. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Local code execution in Microsoft Office stems from a type confusion (CWE-843) flaw that allows an unauthenticated attacker with local access to run arbitrary code in the context of the Office process. The CVSS 8.4 score reflects high impact on confidentiality, integrity, and availability without requiring privileges or user interaction, though the attack vector is local. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV.

Path traversal in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) enables an authenticated low-privileged attacker to execute code over a network by escaping the intended directory scope. Affected builds span all three actively maintained SharePoint Server product lines, with vendor-confirmed patches available for each. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog; however, the low attack complexity (AC:L) and no user interaction requirement (UI:N) make it a credible target for exploitation once an attacker has any valid SharePoint credential.

Cross-site scripting in Microsoft SharePoint Server on-premises deployments (2016, 2019, and Subscription Edition) enables network-based spoofing attacks by injecting malicious script into pages rendered within victims' browser sessions. All three actively supported SharePoint on-premises product lines are affected across broad version ranges, with fixed releases confirmed in the June 2026 patch cycle. No public exploit code has been identified at time of analysis and the vulnerability is absent from the CISA KEV catalog, but low attack complexity and wide enterprise deployment footprint make prompt patching a reasonable priority.

Local code execution in Microsoft Office is possible through a heap-based buffer overflow (CWE-122) that triggers when a user opens or previews a maliciously crafted document. The CVSS 7.8 score reflects local attack vector with required user interaction, and no public exploit identified at time of analysis. Successful exploitation yields full confidentiality, integrity, and availability impact in the context of the current user.

Out-of-bounds read in Microsoft Office triggers local information disclosure when a victim opens a crafted document, exposing adjacent memory contents with high confidentiality impact. The vulnerability spans a wide product surface including Office 2016 through LTSC 2024, Microsoft 365 Apps for Enterprise, multiple SharePoint Server versions, and Mac variants, as confirmed by EUVD-2026-35664. No public exploit or CISA KEV listing is identified at time of analysis; vendor-released patches are available across affected product lines.

Local code execution in Microsoft Office is possible when a user opens a maliciously crafted document that triggers a heap-based buffer overflow (CWE-122), allowing the attacker to run arbitrary code in the context of the opened Office process. The CVSS 7.8 (AV:L/AC:L/PR:N/UI:R) reflects a user-interaction-driven local exploit rather than a remote network attack, and no public exploit identified at time of analysis. The flaw was reported through Microsoft Security Response Center (secure@microsoft.com) and is tracked in MSRC's update guide.

Cross-site scripting in Microsoft SharePoint enables network-based spoofing attacks by injecting malicious scripts into web page output. The vulnerability (CWE-79) targets users of the SharePoint web interface and, when triggered via user interaction, allows an attacker to manipulate page content or impersonate legitimate UI elements - degrading both confidentiality and integrity. No public exploit or active exploitation has been identified at time of analysis, though the low-complexity network vector lowers the bar for opportunistic abuse.

Remote code execution in Microsoft SharePoint Server through unsafe deserialization of untrusted data allows authenticated attackers to execute arbitrary code with high privileges over the network. The vulnerability requires valid user credentials but no user interaction, making it exploitable by any authorized account. No patch is currently available, leaving affected systems vulnerable until Microsoft releases a fix.

Unsafe pointer dereference in Microsoft Office, SharePoint Server, and 365 Apps enables local code execution with high privileges on affected systems. An attacker with local access can exploit this memory safety flaw to achieve complete system compromise including data theft and modification. No patch is currently available, leaving users vulnerable until Microsoft releases a security update.

Remote code execution in Microsoft SharePoint Server allows authenticated users to bypass input validation and execute arbitrary code across the network. This high-severity vulnerability (CVSS 8.8) affects authorized attackers who can leverage improper validation controls to achieve full system compromise. No patch is currently available, making immediate mitigation and access controls critical for affected organizations.

Microsoft SharePoint Server contains a reflected cross-site scripting vulnerability that allows remote attackers to execute arbitrary scripts in users' browsers through malicious links, enabling spoofing attacks and credential theft. The vulnerability requires user interaction to trigger and affects all SharePoint deployments with no available patch. With a CVSS score of 8.1, this poses a significant risk to organizations relying on SharePoint for collaboration.

Microsoft Outlook's unsafe deserialization of untrusted data enables remote attackers to spoof messages and identities without authentication over the network. This vulnerability affects Outlook, Word, and Microsoft 365 Apps, allowing attackers to impersonate legitimate senders and deceive users. No patch is currently available, making this a high-risk threat requiring immediate defensive measures.

Information disclosure in Microsoft Outlook, SharePoint Server, Office, and 365 Apps enables remote attackers to conduct email spoofing attacks without authentication or user interaction. The vulnerability affects multiple Microsoft collaboration products and could allow threat actors to impersonate legitimate senders to compromise organizational security. No patch is currently available for this high-severity issue.

Stored XSS in Microsoft SharePoint Server enables authenticated users to inject malicious scripts that execute in other users' browsers, potentially leading to credential theft or session hijacking. The vulnerability requires user interaction and network access, but no patch is currently available, leaving organizations dependent on compensating controls or vendor updates.

Microsoft SharePoint Server contains a server-side request forgery vulnerability that allows authenticated users to access sensitive information across the network. An attacker with valid credentials can exploit this flaw to disclose confidential data without requiring user interaction. No patch is currently available for this issue.

Local code execution in Microsoft SharePoint Server results from inadequate input validation, enabling attackers with local access to execute arbitrary code with user interaction. The vulnerability affects SharePoint deployments and carries high impact across confidentiality, integrity, and authenticity. No patch is currently available.

Local code execution in Microsoft Office Word (including 365 Apps and SharePoint Server) results from unsafe pointer dereferencing that can be triggered by user interaction with a malicious document. An attacker with local access can exploit this vulnerability to execute arbitrary code with the privileges of the affected user. No patch is currently available for this vulnerability.

SQL injection in Microsoft SharePoint Server enables authenticated attackers to execute arbitrary code remotely through improper sanitization of database queries. This vulnerability affects authorized users with network access and could allow them to compromise affected systems with high-level privileges. No patch is currently available for this issue.

Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally. [CVSS 7.0 HIGH]

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information locally. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Microsoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over the network, with active exploitation confirmed and patches pending full release.

Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Microsoft Office SharePoint contains a code injection vulnerability (CVE-2025-49704, CVSS 8.8) enabling authenticated attackers to execute arbitrary code over the network. KEV-listed with EPSS 63.8%, this vulnerability requires only basic SharePoint authentication and enables server-level code execution, threatening the documents, workflows, and data stored across the organization's SharePoint infrastructure.

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

SQL injection vulnerability in Microsoft Office SharePoint that allows authenticated attackers to execute arbitrary code remotely without user interaction. The vulnerability affects SharePoint deployments where an authorized user can craft malicious SQL commands through improperly neutralized input fields. This is a high-severity issue (CVSS 8.8) with significant confidentiality, integrity, and availability impact, particularly concerning given SharePoint's role as a critical enterprise collaboration platform.

Heap-based buffer overflow vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary code with high impact on confidentiality, integrity, and availability. The vulnerability requires user interaction (opening a malicious document) but no elevated privileges, making it a significant local code execution threat affecting Word users who open untrusted documents.

Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary code with high severity (CVSS 7.8). The vulnerability requires user interaction (opening a malicious document) but grants complete system compromise through code execution. This is a memory safety issue (CWE-416) in Word's document processing engine that could be actively exploited if public POC becomes available.

Critical deserialization vulnerability in Microsoft Office SharePoint that allows authenticated attackers to execute arbitrary code remotely with high impact to confidentiality, integrity, and availability. The vulnerability affects SharePoint environments where an authorized user can submit malicious serialized objects, bypassing input validation due to unsafe deserialization practices (CWE-502). While the attack requires valid credentials (PR:L), the network-accessible attack vector (AV:N), low attack complexity (AC:L), and high CVSS score of 8.8 indicate significant real-world risk, particularly in organizations with broad internal user bases or federated access.

Critical deserialization vulnerability in Microsoft Office SharePoint that allows authenticated attackers to execute arbitrary code remotely without user interaction. The vulnerability affects SharePoint environments where untrusted data is deserialized, enabling network-based code execution with high impact to confidentiality, integrity, and availability. While no public exploit code has been confirmed in open intelligence sources, the CVSS 8.8 rating and low attack complexity suggest this is a high-priority patch for all affected organizations.

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.4), this vulnerability is no authentication required. No vendor patch available.