This vulnerability (CVE-2026-33113) affects Microsoft SharePoint Enterprise Server 2016 version 16.0.0. It is classified as CWE-79, indicating improper neutralization of input during web page generation, leading to cross-site scripting (XSS). The flaw allows an unauthorized attacker to conduct spoofing attacks over a network by injecting malicious scripts. The CVSS 3.1 base score is 5.4 (medium severity), with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity. Microsoft has published an official fix to address this vulnerability.

Successful exploitation could allow an attacker to perform spoofing attacks by injecting malicious scripts into web pages generated by SharePoint, potentially compromising confidentiality and integrity of user data. There is no impact on availability. No known exploits are currently reported in the wild.

An official fix is available from Microsoft. Users should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33113 to remediate this vulnerability.