This vulnerability (CVE-2026-47637) in Microsoft SharePoint Enterprise Server 2016 (version 16.0.0) is classified as CWE-79, indicating improper neutralization of input during web page generation, commonly known as cross-site scripting (XSS). The flaw allows an attacker with authorized access to craft malicious input that is not properly sanitized, potentially enabling spoofing attacks over a network. The CVSS v3.1 base score is 4.6 (medium severity), reflecting low impact on confidentiality and integrity, no impact on availability, and requiring low attack complexity with privileges and user interaction. Microsoft has issued an official fix for this vulnerability.

An authorized attacker can exploit this vulnerability to perform spoofing attacks by injecting malicious scripts into web pages generated by SharePoint. The impact includes limited confidentiality and integrity loss but no availability impact. The attack requires the attacker to have some privileges and user interaction to succeed.

Microsoft has released an official fix for this vulnerability. Users of Microsoft SharePoint Enterprise Server 2016 version 16.0.0 should apply the provided security update as soon as possible. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47637 for detailed patch information and installation instructions.