CVE-2026-69615: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Microsoft Microsoft SharePoint Server Subscription Edition

This vulnerability (CVE-2026-69615) in Microsoft SharePoint Server Subscription Edition is caused by improper neutralization of input during web page generation, classified as CWE-79 (Cross-site Scripting). It allows an attacker with authorized access and user interaction to perform spoofing attacks over a network. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and low confidentiality and integrity impact with no availability impact. Microsoft has published an official fix for this vulnerability.

An authorized attacker can exploit this vulnerability to perform spoofing attacks, potentially misleading users by injecting malicious scripts into web pages generated by SharePoint Server. The impact on confidentiality and integrity is low, and there is no impact on availability. No known exploits are reported in the wild.

An official fix is available from Microsoft. Users should apply the provided security update as per the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69615 to remediate this vulnerability.