CVE-2026-69402: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Microsoft Microsoft SharePoint Server Subscription Edition

This vulnerability (CVE-2026-69402) is classified as CWE-79, indicating improper neutralization of input during web page generation in Microsoft SharePoint Server Subscription Edition. It allows an attacker with authorized access to conduct cross-site scripting attacks that can lead to spoofing over a network. The CVSS 3.1 base score is 7.3, reflecting high severity with high impact on confidentiality and integrity but no impact on availability. The vulnerability requires low attack complexity and privileges, with user interaction required. Microsoft has published an official fix for affected versions.

An authorized attacker can exploit this vulnerability to perform cross-site scripting attacks, potentially leading to spoofing and unauthorized disclosure or modification of sensitive information within Microsoft SharePoint Server Subscription Edition environments. The impact is rated high for confidentiality and integrity, but availability is not affected.

An official fix is available from Microsoft. Users should apply the security update provided by Microsoft for SharePoint Server Subscription Edition versions 16.0.0 and later up to 16.0.20326.20090 to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69402 for detailed patching instructions.