CVE-2026-64922

sharepoint_server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2026-64922)

Affected

microsoft/sharepoint_server lt *..16.0.19725.20522

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Source: BSI WID Portal BSI CSAF cvelistv5 NVD (NIST)Microsoft Security Update Guide

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

microsoftsharepoint_server

16.0.19725.20522fixed from 16.0.19725.20522

Metrics

XIEM Effective CVSS

5.4

Source: nvd-v3

EPSS percentile

46.2 %

High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).

KEV status

—

Show all metrics

Severity

medium

65.09

no public PoC known

4.6

0.6 %

Low — model estimates < 1% exploitation likelihood.

Published

2026-08-11 17:04 UTC

CWE

CWE-79

Weakness classes (CWE)

CWE-79Base
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
cwe.mitre.org →

References & sources

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64922
vendor-advisorypatch

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

New CVE Received2026-08-11 17:18 UTC· secure@microsoft.com
- Affected: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition
- Description: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- CVSS V3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
- CWE: CWE-79