CVE-2026-97783: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Microsoft Microsoft SharePoint Server 2019

This vulnerability (CVE-2026-97783) in Microsoft SharePoint Server 2019 is classified as CWE-79, indicating improper neutralization of input during web page generation, commonly known as cross-site scripting (XSS). An attacker can exploit this flaw to perform spoofing attacks over a network by injecting malicious scripts into web pages generated by SharePoint. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality and integrity, with no privileges required and low attack complexity. Microsoft has published an official fix to address this issue.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected SharePoint web application, leading to spoofing attacks that compromise confidentiality and integrity of data. This could result in unauthorized actions performed on behalf of users or disclosure of sensitive information. Availability is not impacted.

An official fix is available from Microsoft for this vulnerability. Users and administrators of Microsoft SharePoint Server 2019 should apply the security update provided by Microsoft as detailed in their advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97783. No additional mitigation steps are indicated beyond applying the official patch.