Access: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2026-64902)

Weakness-Klassen (CWE)

• CWE-79Base

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

  cwe.mitre.org →

Re-Analyse & Statuswechsel

Chronologie der NVD-Audit-Events für diese CVE — Reanalyses, CVSS-Updates, CPE-Diffs.

1. Initial Analysis2026-08-11 20:54 UTC· nvd@nist.gov
   • CVSS V3.1: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
   • CPE Configuration: OR *cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* *cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:* *cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:* versions up to (excluding) 16.0.19725.20522
   • Reference Type: Microsoft Corporation: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64902 Types: Patch, Vendor Advisory
2. CVE Modified2026-08-11 19:18 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
   • SSVC: {"id":"CVE-2026-64902","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…
3. New CVE Received2026-08-11 17:18 UTC· secure@microsoft.com
   • Affected: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition
   • Description: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
   • CVSS V3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
   • CWE: CWE-79

Betroffene Produkte

Aus der Hersteller-/CERT-Meldung extrahierte Produkte und Versionsbereiche. Ein Version-Range wie „<4.14.6“ impliziert die Update-Empfehlung „auf 4.14.6 oder höher aktualisieren“.

• Microsoft

  Access2016

• Microsoft

  AzureSQL Managed Instance

• Microsoft

  Excel2016

• Microsoft

  Office2016

• Microsoft

  Office2019

• Microsoft

  OfficeLTSC 2021

• Microsoft

  OfficeLTSC 2024

• Microsoft

  OfficeLTSC for Mac 2021

• Microsoft

  OfficeLTSC for Mac 2024

• Microsoft

  Office 365for Mac

• Microsoft

  OneDrivefor MacOS

• Microsoft

  Outlook2016

• Microsoft

  PowerPoint2016

• Microsoft

  Service BusAzure Service Bus

• Microsoft

  SharePointEnterprise Server 2016

• Microsoft

  SharePointOnline

• Microsoft

  SharePointServer Subscription Edition

• Microsoft

  Teamsfor Android

• Microsoft

  Teamsfor iOS

• Microsoft

  Word2016

Quellen & Referenzen

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64902
  vendor-advisorypatch

Verknüpfte Empfehlungen

• ncsc-nl2026-08-27 10:23 UTC
  NCSC-2026-0286 [1.01] [H/H] Kwetsbaarheden verholpen in Microsoft Office
• sans-atrisk-mail2026-08-13 00:00 UTC
  @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 31