This vulnerability (CVE-2026-70332) in Microsoft SharePoint Online involves improper neutralization of input during web page generation, classified under CWE-79 (Cross-site Scripting) and CWE-918. It enables an attacker to conduct spoofing attacks remotely without privileges, requiring user interaction. The CVSS 3.1 base score is 9.6 (critical), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and complete impact on confidentiality, integrity, and availability. Microsoft has released an official fix for this vulnerability.

Successful exploitation can lead to spoofing attacks that compromise user trust and potentially allow attackers to execute arbitrary scripts in the context of the affected SharePoint Online environment. The vulnerability impacts confidentiality, integrity, and availability of the service, making it critical for organizations using SharePoint Online.

An official fix is available from Microsoft. Users and administrators should apply the update provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70332 to remediate this vulnerability. No additional mitigation steps are indicated beyond applying the official patch.