This vulnerability (CVE-2026-47639) affects Microsoft SharePoint Enterprise Server 2016 (version 16.0.0). It is classified as CWE-79, indicating improper neutralization of input during web page generation, which leads to cross-site scripting (XSS). An attacker can exploit this flaw to perform spoofing attacks over a network. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity), with network attack vector, low attack complexity, no privileges required, and requires user interaction. Microsoft has released an official fix to address this issue.

Successful exploitation of this vulnerability could allow an attacker to execute cross-site scripting attacks, potentially enabling spoofing of web content and misleading users. The impact includes limited confidentiality and integrity loss but no availability impact. This could lead to unauthorized actions performed in the context of the affected SharePoint web application.

An official fix is available from Microsoft. Users and administrators of Microsoft SharePoint Enterprise Server 2016 should apply the provided security update as soon as possible to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47639 for the patch and detailed remediation instructions.