This vulnerability (CVE-2026-45481) in Microsoft SharePoint Enterprise Server 2016 is classified as CWE-79, indicating improper neutralization of input during web page generation, commonly known as cross-site scripting (XSS). The flaw allows an attacker with authorized access to the SharePoint server to inject malicious scripts that can spoof content when rendered in a user's browser. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, user interaction, and high impact on confidentiality and integrity. Microsoft has published an official fix for this vulnerability.

Exploitation of this vulnerability could allow an authorized attacker to execute arbitrary scripts in the context of the affected SharePoint site, potentially leading to spoofing attacks and unauthorized disclosure or modification of sensitive information. The vulnerability does not impact availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users of Microsoft SharePoint Enterprise Server 2016 version 16.0.0 should apply the vendor-provided patch as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45481 to remediate this vulnerability.