Cross-Site Scripting Vulnerability in Microsoft Office SharePoint
CVE-2026-26105

8.1HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft Sharepoint Enterprise Server 2016
Microsoft Sharepoint Server 2019
Microsoft Sharepoint Server Subscription Edition
Vendor
CVE Published:
10 March 2026

What is CVE-2026-26105?

The vulnerability stems from inadequate input validation during web page generation in Microsoft Office SharePoint, allowing attackers to inject malicious scripts. This can lead to unauthorized actions performed on behalf of legitimate users, making it a serious concern for organizations relying on SharePoint for collaboration and document management.

Affected Version(s)

Microsoft SharePoint Enterprise Server 2016 x64-based Systems 16.0.0 < 16.0.5543.1000

Microsoft SharePoint Server 2019 x64-based Systems 16.0.0 < 16.0.10417.20102

Microsoft SharePoint Server Subscription Edition x64-based Systems 16.0.0 < 16.0.19725.20076

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.