This vulnerability (CVE-2026-45479) affects Microsoft SharePoint Enterprise Server 2016 version 16.0.0. It is categorized as CWE-79, indicating improper neutralization of input during web page generation, leading to cross-site scripting. The flaw allows an authorized attacker to conduct spoofing attacks over a network by injecting malicious input that is not properly sanitized. The CVSS 3.1 base score is 4.6 (medium severity), with vector AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, indicating network attack vector, low attack complexity, requiring low privileges and user interaction, with limited confidentiality and integrity impact and no availability impact. Microsoft has issued an official fix for this vulnerability.

An authorized attacker with low privileges can exploit this vulnerability over the network to perform spoofing attacks via cross-site scripting. The impact is limited to partial confidentiality and integrity loss without affecting availability. There are no known exploits in the wild at this time.

Microsoft has released an official fix for this vulnerability. Users of Microsoft SharePoint Enterprise Server 2016 version 16.0.0 should apply the vendor-provided patch as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45479 to remediate this issue.