This vulnerability (CWE-79) in Microsoft SharePoint Enterprise Server 2016 (version 16.0.0) allows an attacker to inject malicious scripts due to improper input sanitization during web page generation. Exploitation could lead to spoofing attacks, potentially impacting confidentiality and integrity. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. Microsoft has published an official fix for this issue.

Successful exploitation could allow an attacker to perform spoofing attacks by injecting malicious scripts, potentially leading to limited confidentiality and integrity impacts. There is no impact on availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45464 to remediate this vulnerability.