This vulnerability (CVE-2026-45468) in Microsoft SharePoint Enterprise Server 2016 is classified as CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as cross-site scripting (XSS). It allows an authorized attacker to inject malicious scripts by exploiting insufficient input sanitization in the web page generation process. The attacker can leverage this to perform spoofing attacks over a network. The vulnerability affects version 16.0.0 of SharePoint Enterprise Server 2016. Microsoft has issued an official fix to address this issue.

The vulnerability allows an authorized attacker to conduct spoofing attacks by injecting malicious scripts into web pages generated by SharePoint. This can lead to limited confidentiality and integrity impacts, such as executing unauthorized scripts in the context of a user's browser session. There is no impact on availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft for this vulnerability. Administrators should apply the provided security update from the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45468 to remediate the issue.