Cross-Site Scripting Vulnerability in Microsoft Office SharePoint
CVE-2026-55135

4.6MEDIUM

Key Information:

Vendor

Microsoft
Status
Microsoft Sharepoint Enterprise Server 2016
Microsoft Sharepoint Server 2019
Microsoft Sharepoint Server Subscription Edition
Vendor
CVE Published:
14 July 2026

What is CVE-2026-55135?

A vulnerability exists in Microsoft Office SharePoint that allows for improper neutralization of input during web page generation. This security flaw enables an authorized attacker to execute cross-site scripting attacks, potentially leading to spoofing over the network. If exploited, an attacker could inject malicious scripts into web pages viewed by other users, which could then be used to steal sensitive information or manipulate user sessions.

Affected Version(s)

Microsoft SharePoint Enterprise Server 2016 x64-based Systems 16.0.0 < 16.0.5561.1001

Microsoft SharePoint Server 2019 x64-based Systems 16.0.0 < 16.0.10417.20175

Microsoft SharePoint Server Subscription Edition x64-based Systems 16.0.0 < 16.0.19725.20434

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.