This vulnerability (CVE-2026-45481) affects Microsoft SharePoint Enterprise Server 2016 (version 16.0.0). It is classified as CWE-79, indicating improper neutralization of input during web page generation, leading to cross-site scripting. An authorized attacker with limited privileges can exploit this vulnerability to perform spoofing attacks, potentially compromising confidentiality and integrity. The CVSS 3.1 base score is 7.3 (high), with network attack vector, low attack complexity, required privileges, and user interaction. Microsoft has released an official fix to address this issue.

Successful exploitation can lead to high impact on confidentiality and integrity by enabling spoofing attacks via cross-site scripting. Availability is not affected. The attacker must be authorized and require user interaction to exploit.

An official fix is available from Microsoft. Users should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45481 to remediate this vulnerability.