This vulnerability (CVE-2026-26105) in Microsoft SharePoint Enterprise Server 2016 (version 16.0.0) is caused by improper neutralization of input during web page generation, classified under CWE-79 (Cross-site Scripting). It enables an attacker without privileges to execute spoofing attacks by injecting malicious scripts into web pages. The CVSS v3.1 base score is 8.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality and integrity. The vulnerability is publicly known and a patch is available from Microsoft.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected SharePoint site, leading to spoofing attacks that compromise confidentiality and integrity of user data. Availability is not impacted. There are no known exploits in the wild at this time.

An official patch is available for Microsoft SharePoint Enterprise Server 2016 to remediate this vulnerability. It is recommended to apply the patch promptly to mitigate the risk. Since this is not a cloud service, remediation depends on the customer applying the update. No additional vendor advisories indicate alternative mitigations or that no action is required.