This vulnerability (CVE-2026-47634) in Microsoft SharePoint Server 2019 arises from improper neutralization of special elements in output that is consumed by a downstream component, classified under CWE-74 (Injection). The flaw enables an attacker with authorized access to perform spoofing attacks over a network, potentially impacting confidentiality and integrity. The CVSS v3.1 base score is 7.3, indicating high severity, with network attack vector, low attack complexity, required privileges, and user interaction. Microsoft has released an official fix for this vulnerability.

An authorized attacker can exploit this injection vulnerability to spoof network communications, potentially leading to unauthorized disclosure or manipulation of information. The vulnerability affects confidentiality and integrity but does not impact availability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users of Microsoft SharePoint Server 2019 version 16.0.0 should apply the vendor-provided patch as soon as possible to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47634 for detailed update instructions.