CVE-2026-69690: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Microsoft Microsoft SharePoint Server Subscription Edition

This vulnerability (CWE-79) in Microsoft SharePoint Server Subscription Edition arises from improper neutralization of input during web page generation, which can lead to cross-site scripting attacks. An attacker with authorized access can exploit this flaw to perform spoofing attacks over a network. The CVSS 3.1 base score is 4.6 (medium severity), reflecting network attack vector, low complexity, required privileges, and user interaction. The vulnerability affects versions >=16.0.0 and <16.0.20326.20090. Microsoft has published an official fix for this issue.

An authorized attacker can exploit this vulnerability to perform spoofing attacks via cross-site scripting, potentially misleading users or executing unauthorized scripts in the context of the affected SharePoint server. The impact includes limited confidentiality and integrity loss but no availability impact. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users should apply the patch for Microsoft SharePoint Server Subscription Edition to versions 16.0.20326.20090 or later as provided in the Microsoft Security Response Center advisory. No additional mitigation steps are required beyond applying the official update.