This vulnerability (CVE-2026-20945) affects Microsoft SharePoint Enterprise Server 2016 (version 16.0.0) and is classified as CWE-79, indicating improper neutralization of input during web page generation leading to cross-site scripting. An authorized attacker with privileges can exploit this flaw to conduct spoofing attacks over a network. The CVSS 3.1 base score is 4.6 (medium), reflecting low attack complexity, required privileges, and user interaction. Microsoft has published an official fix for this vulnerability, as detailed in their security update guide.

Successful exploitation could allow an authorized attacker to perform spoofing attacks, potentially misleading users or systems by injecting malicious scripts into web pages generated by SharePoint. The confidentiality and integrity impacts are limited (low), and there is no impact on availability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators of Microsoft SharePoint Enterprise Server 2016 should apply the security update provided by Microsoft as soon as possible. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20945 for detailed patching instructions.