This vulnerability (CWE-74) in Microsoft SharePoint Server 2019 arises from improper neutralization of special elements in output that is consumed by downstream components, enabling injection attacks. The issue permits an attacker with authorized access to conduct spoofing over a network, potentially compromising confidentiality and integrity. The CVSS v3.1 base score is 7.3, reflecting high severity with network attack vector, low attack complexity, and required privileges. Microsoft has published an official fix for this vulnerability.

An authorized attacker can exploit this vulnerability to perform spoofing attacks over a network, which can lead to unauthorized disclosure and modification of information (high confidentiality and integrity impact). Availability is not affected. The attack requires user interaction and privileges but can be executed remotely.

An official fix is available from Microsoft. Users of Microsoft SharePoint Server 2019 version 16.0.0 should apply the vendor-provided patch as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47634. Applying this update will remediate the vulnerability.