This vulnerability (CVE-2026-26105) in Microsoft SharePoint Enterprise Server 2016 is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as cross-site scripting (XSS). It allows an attacker to inject malicious scripts by exploiting insufficient input sanitization in web page generation, potentially enabling spoofing attacks. The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, and user interaction needed. Confidentiality and integrity impacts are high, while availability is not affected. Microsoft has issued an official fix for this vulnerability.

Successful exploitation can lead to high confidentiality and integrity impacts, such as unauthorized disclosure of information and manipulation of data or user sessions via spoofing attacks. The vulnerability requires user interaction but no privileges or authentication, making it a significant risk in network-exposed environments. Availability is not impacted.

An official fix is available from Microsoft for this vulnerability. Users of Microsoft SharePoint Enterprise Server 2016 version 16.0.0 should apply the provided security update as soon as possible. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26105 for detailed patching instructions and update information.