Cross-Site Scripting Vulnerability in Microsoft Office SharePoint
CVE-2026-88209

4.6MEDIUM

Key Information:

Vendor

Microsoft
Status
Microsoft Sharepoint Server Subscription Edition
Vendor
CVE Published:
13 October 2026

What is CVE-2026-88209?

The vulnerability arises from inadequate input sanitization during the generation of web pages in Microsoft Office SharePoint, enabling an authorized attacker to launch spoofing attacks over a network. This could potentially allow the attacker to manipulate content, access sensitive information, or deceive users into taking harmful actions. Immediate attention and remediation are essential to mitigate the risks associated with this security flaw.

Affected Version(s)

Microsoft SharePoint Server Subscription Edition x64-based Systems 16.0.0 < 16.0.20326.20190

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.