This vulnerability (CVE-2026-48562) affects Microsoft SharePoint Enterprise Server 2016 (version 16.0.0). It is classified as CWE-79, indicating improper neutralization of input during web page generation, leading to cross-site scripting (XSS). The flaw allows an authorized attacker to conduct spoofing attacks over a network by injecting malicious scripts. The CVSS 3.1 base score is 4.6 (medium severity), with an attack vector of network, low attack complexity, requiring privileges and user interaction, and impacts confidentiality and integrity with no impact on availability. Microsoft has issued an official fix for this vulnerability, as detailed in their security update advisory.

Successful exploitation of this vulnerability could allow an authorized attacker to perform spoofing attacks, potentially leading to limited confidentiality and integrity impacts within the affected SharePoint environment. The vulnerability does not affect availability and requires user interaction and privileges to exploit.

An official fix is available from Microsoft for this vulnerability. Administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48562 to remediate the issue.