What happened
A vulnerability has been identified in Microsoft SharePoint Server Subscription Edition that allows for cross-site scripting (XSS) due to improper neutralization of input during web page generation. This flaw, identified as CVE-2026-102859, enables an authorised attacker to perform spoofing by delivering malicious content that can be executed within the context of a trusted user’s browser. The vulnerability is exploitable remotely over a network and involves content that the victim opens or interacts with, such as a web page or file.
The attack requires the attacker to have low-level access and for the affected user to take an action, such as opening a file or visiting a web page containing the malicious content. The issue stems from insufficient filtering of input during web page rendering, which could lead to malicious scripts executing in the context of the user’s session, although it does not permit remote code execution or privilege escalation. The severity is rated as medium, with a CVSS score of 4.6, reflecting its partial impact and reliance on user interaction.
Who is affected
Organisations running affected versions of Microsoft SharePoint Server Subscription Edition are impacted by this vulnerability. Specifically, those with versions from 16.0.0 up to, but not including, 16.0.20326.20190 are vulnerable. The flaw applies to systems that are based on the x64 architecture. No other SharePoint versions or components are currently confirmed to be affected.
Recommended actions
Implement measures to control the delivery and rendering of untrusted web content, such as mail and web downloads, to prevent malicious content from reaching the affected site.
Utilise content filtering, blocking, or sandboxing of potentially malicious files or web content to reduce the risk of exploitability.
Apply attack-surface reduction strategies on software that opens untrusted content to limit potential exploitation pathways.
Enhance user awareness by informing about the importance of cautious interaction with unknown web pages or files, especially in environments where SharePoint is used.
