Cross-Site Scripting Vulnerability in Microsoft SharePoint by Microsoft
CVE-2026-47636

5.4MEDIUM

Key Information:

Vendor: Microsoft
Status: Microsoft Sharepoint Enterprise Server 2016; Microsoft Sharepoint Server 2019; Microsoft Sharepoint Server Subscription Edition
Vendor: CVE Published:; 9 June 2026

What is CVE-2026-47636?

A cross-site scripting vulnerability exists in Microsoft SharePoint due to improper neutralization of user input during web page generation. This flaw enables an authorized attacker to execute spoofing attacks over the network, potentially affecting the integrity and confidentiality of sensitive information. Implementing proper input validation and sanitization techniques is crucial for mitigating this risk.

Affected Version(s)

Microsoft SharePoint Enterprise Server 2016 x64-based Systems 16.0.0 < 16.0.5556.1005

Microsoft SharePoint Server 2019 x64-based Systems 16.0.0 < 16.0.10417.20153

Microsoft SharePoint Server Subscription Edition x64-based Systems 16.0.0 < 16.0.19725.20384

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...

vendor-advisorypatch

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 9, 2026
Vulnerability Reserved
May 19, 2026

CVE-2026-47636 Data

JSON