CVE-2026-88209: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Microsoft Microsoft SharePoint Server Subscription Edition

This vulnerability (CWE-79) in Microsoft SharePoint Server Subscription Edition allows an authorized attacker to exploit improper input neutralization during web page generation, resulting in cross-site scripting (XSS). The attacker can perform spoofing attacks over the network by injecting malicious scripts. The CVSS 3.1 base score is 4.6 (medium severity), reflecting low confidentiality and integrity impact with no availability impact. The vulnerability requires low attack complexity, privileges, and user interaction. Microsoft has published an official fix for affected versions.

An authorized attacker can exploit this vulnerability to perform spoofing attacks via cross-site scripting, potentially leading to limited confidentiality and integrity impacts. There is no impact on availability. The attack requires network access, low complexity, and some privileges with user interaction.

An official fix is available from Microsoft. Users should apply the security update for Microsoft SharePoint Server Subscription Edition versions >=16.0.0 <16.0.20326.20190 as provided in the Microsoft Security Response Center advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88209).