Cross-Site Scripting Vulnerability in Microsoft Office SharePoint
CVE-2026-45465

5.4MEDIUM

Key Information:

Vendor: Microsoft
Status: Microsoft Sharepoint Enterprise Server 2016; Microsoft Sharepoint Server 2019; Microsoft Sharepoint Server Subscription Edition
Vendor: CVE Published:; 9 June 2026

What is CVE-2026-45465?

An improper handling of input during the generation of web pages in Microsoft Office SharePoint allows an authorized attacker to exploit the system via cross-site scripting (XSS). This vulnerability can lead to unauthorized actions being performed on behalf of legitimate users, effectively enabling spoofing attacks over the network.

Affected Version(s)

Microsoft SharePoint Enterprise Server 2016 x64-based Systems 16.0.0 < 16.0.5556.1005

Microsoft SharePoint Server 2019 x64-based Systems 16.0.0 < 16.0.10417.20153

Microsoft SharePoint Server Subscription Edition x64-based Systems 16.0.0 < 16.0.19725.20384

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...

vendor-advisorypatch

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 9, 2026
Vulnerability Reserved
May 12, 2026

CVE-2026-45465 Data

JSON