Cross-Site Scripting Vulnerability in Microsoft Office SharePoint
CVE-2026-26105

8.1HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft Sharepoint Enterprise Server 2016
Microsoft Sharepoint Server 2019
Microsoft Sharepoint Server Subscription Edition
Vendor
CVE Published:
10 March 2026

What is CVE-2026-26105?

The vulnerability stems from inadequate input validation during web page generation in Microsoft Office SharePoint, allowing attackers to inject malicious scripts. This can lead to unauthorized actions performed on behalf of legitimate users, making it a serious concern for organizations relying on SharePoint for collaboration and document management.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Microsoft SharePoint Enterprise Server 2016 x64-based Systems 16.0.0 < 16.0.5543.1000

Microsoft SharePoint Server 2019 x64-based Systems 16.0.0 < 16.0.10417.20102

Microsoft SharePoint Server Subscription Edition x64-based Systems 16.0.0 < 16.0.19725.20076

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.