Cross-Site Scripting Vulnerability in Microsoft Office SharePoint
CVE-2026-20945

4.6MEDIUM

Key Information:

Vendor

Microsoft
Status
Microsoft Sharepoint Enterprise Server 2016
Microsoft Sharepoint Server 2019
Microsoft Sharepoint Server Subscription Edition
Vendor
CVE Published:
14 April 2026

What is CVE-2026-20945?

An input handling issue in Microsoft Office SharePoint facilitates cross-site scripting attacks. This vulnerability enables an authorized attacker to inject malicious scripts, potentially leading to user data spoofing and unauthorized actions across the network.

Affected Version(s)

Microsoft SharePoint Enterprise Server 2016 x64-based Systems 16.0.0 < 16.0.5548.1003

Microsoft SharePoint Server 2019 x64-based Systems 16.0.0 < 16.0.10417.20114

Microsoft SharePoint Server Subscription Edition x64-based Systems 16.0.0 < 16.0.19725.20210

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

EPSS Score

25% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.