Cross-Site Scripting Vulnerability in Microsoft Office SharePoint
CVE-2026-64916

4.6MEDIUM

Key Information:

Vendor

Microsoft
Status
Microsoft Sharepoint Enterprise Server 2016
Microsoft Sharepoint Server 2019
Microsoft Sharepoint Server Subscription Edition
Vendor
CVE Published:
11 August 2026

What is CVE-2026-64916?

An improper neutralization of input during web page generation in Microsoft Office SharePoint creates a potential for cross-site scripting attacks. This vulnerability can be exploited by authorized attackers to execute unauthorized scripts in the context of a user's session, enabling them to impersonate users and manipulate web content without their knowledge or consent. Proper validation and sanitization of user inputs are essential in mitigating such risks.

Affected Version(s)

Microsoft SharePoint Enterprise Server 2016 x64-based Systems 16.0.0 < 16.0.5565.1001

Microsoft SharePoint Server 2019 x64-based Systems 16.0.0 < 16.0.10417.20198

Microsoft SharePoint Server Subscription Edition x64-based Systems 16.0.0 < 16.0.19725.20522

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.