This vulnerability (CWE-79) in Microsoft SharePoint Enterprise Server 2016 (version 16.0.0) allows an authorized attacker to inject malicious scripts due to improper input neutralization during web page generation. The flaw can be exploited to perform spoofing attacks, potentially impacting confidentiality and integrity. The CVSS 3.1 base score is 4.6 (medium severity), reflecting network attack vector, low complexity, required privileges, and user interaction. Microsoft has released an official fix to address this issue.

Successful exploitation could allow an authorized attacker to conduct spoofing attacks, potentially leading to limited confidentiality and integrity impacts. There is no impact on availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48562 to remediate this vulnerability.