This vulnerability (CVE-2025-21393) in Microsoft SharePoint Enterprise Server 2016 is classified as CWE-79, indicating improper neutralization of input during web page generation, commonly known as cross-site scripting (XSS). The CVSS 3.1 base score is 6.3 (medium severity) with network attack vector, low attack complexity, requiring low privileges and user interaction. The impact includes high confidentiality impact and low integrity impact, with no availability impact. Microsoft has published an official fix for this vulnerability, and the vendor advisory is available at the Microsoft Security Response Center.

An attacker with low privileges and requiring user interaction could exploit this vulnerability to execute malicious scripts in the context of the affected SharePoint server, potentially leading to disclosure of sensitive information (high confidentiality impact) and limited integrity impact. There is no impact on availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft for this vulnerability. It is recommended to apply the provided security update as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21393. No additional mitigation steps are indicated by the vendor advisory.