This vulnerability (CWE-74) in Microsoft SharePoint Server 2019 arises from improper neutralization of special elements in output used by a downstream component, specifically during web page generation. It enables an authorized attacker to conduct cross-site scripting attacks, potentially allowing spoofing over a network. The CVSS 3.1 base score is 7.3, indicating high severity, with network attack vector, low attack complexity, and requiring privileges and user interaction. Microsoft has published an official fix for this issue.

Successful exploitation can lead to high impact on confidentiality and integrity due to cross-site scripting, allowing an attacker with authorized access to spoof content or perform actions in the context of a legitimate user. Availability is not impacted. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users of Microsoft SharePoint Server 2019 version 16.0.0 should apply the vendor-provided patch as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47634. No additional mitigation steps are indicated by the vendor.