Cross-Site Scripting Flaw in Microsoft Office SharePoint
CVE-2026-55126

7.3HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft Sharepoint Enterprise Server 2016
Microsoft Sharepoint Server 2019
Microsoft Sharepoint Server Subscription Edition
Vendor
CVE Published:
14 July 2026

What is CVE-2026-55126?

A cross-site scripting vulnerability in Microsoft Office SharePoint allows attackers to inject malicious scripts via improperly sanitized input during web page generation. This flaw enables an authorized attacker to perform spoofing attacks over a network, potentially compromising user sessions or manipulating users into divulging sensitive information. It's crucial for users to apply necessary patches and implement security best practices to mitigate the risk associated with this vulnerability.

Affected Version(s)

Microsoft SharePoint Enterprise Server 2016 x64-based Systems 16.0.0 < 16.0.5561.1001

Microsoft SharePoint Server 2019 x64-based Systems 16.0.0 < 16.0.10417.20175

Microsoft SharePoint Server Subscription Edition x64-based Systems 16.0.0 < 16.0.19725.20434

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.