CVE-2026-69417: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Microsoft Microsoft SharePoint Server Subscription Edition

This vulnerability (CWE-79) in Microsoft SharePoint Server Subscription Edition arises from improper neutralization of input during web page generation, enabling cross-site scripting attacks. An attacker with authorized access can exploit this flaw to perform spoofing attacks over a network. The CVSS v3.1 base score is 7.3, reflecting high impact on confidentiality and integrity with low attack complexity and requiring privileges and user interaction. The vulnerability affects versions >=16.0.0 and <16.0.20326.20090. Microsoft has published an official fix for this issue.

Successful exploitation allows an authorized attacker to conduct spoofing attacks that can compromise confidentiality and integrity of data within the affected SharePoint environment. There is no indication of availability impact. The vulnerability requires the attacker to have some privileges and user interaction, limiting the attack scope to authorized users.

An official fix is available from Microsoft. Administrators should apply the security update referenced in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69417 to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.