This vulnerability (CVE-2025-64672) affects Microsoft SharePoint Server Subscription Edition 16.0.0 and is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It allows an attacker with authorized access to inject malicious input that is not properly sanitized, resulting in cross-site scripting. This can enable spoofing attacks, potentially compromising user data and system integrity. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is published and a patch is available.

Successful exploitation of this vulnerability can lead to execution of malicious scripts in the context of the affected SharePoint server, enabling spoofing and potentially compromising sensitive information, altering data, or disrupting service availability. The attacker must have authorized access, but no user interaction is required for exploitation. The high CVSS score reflects severe potential impact on confidentiality, integrity, and availability of the system.

A patch is available for this vulnerability. It is recommended to apply the official Microsoft update for SharePoint Server Subscription Edition 16.0.0 as soon as possible to remediate the issue. Since this is not a cloud service, remediation depends on applying the patch on-premises. No additional mitigation guidance is provided or required beyond applying the patch.