This vulnerability (CVE-2026-33113) in Microsoft SharePoint Enterprise Server 2016 is classified as CWE-79, indicating improper neutralization of input during web page generation, which leads to cross-site scripting (XSS). This flaw allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser, enabling spoofing attacks over a network. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and requiring user interaction. Microsoft has issued an official fix for this vulnerability.

An attacker exploiting this vulnerability could perform cross-site scripting attacks, potentially leading to spoofing and limited information disclosure in the context of affected SharePoint web pages. The impact includes low confidentiality and integrity loss but no availability impact. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators of Microsoft SharePoint Enterprise Server 2016 should apply the vendor-provided patch as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33113 to remediate this vulnerability.