CVE-2026-45453: Microsoft SharePoint Cross-Site Scripting (XSS) Vulnerability

Technical summary

This is a reflected or stored XSS flaw (CWE-79) stemming from inadequate input sanitization during web page generation in SharePoint. The vulnerability allows an unauthenticated attacker to inject arbitrary HTML and JavaScript that executes in the victim's browser context with user-level permissions. The CVSS 3.1 score of 5.4 reflects network-based attack vector, low attack complexity, no privilege requirement, and user interaction—resulting in low confidentiality and integrity impact but no availability impact. The attack surface is limited to users actively interacting with SharePoint web interfaces.

Business impact

SharePoint administrators and organizations relying on SharePoint for collaboration must assume that users could be socially engineered into clicking malicious links that exfiltrate session tokens, credentials, or sensitive document metadata. Attackers could impersonate trusted SharePoint administrators or colleagues, potentially disrupting team workflows and eroding trust in internal collaboration platforms. The reputational risk includes potential disclosure of confidential information through spoofed communications appearing to originate from SharePoint accounts.

Affected systems

Microsoft SharePoint Server is affected. The vendor product listing indicates multiple SharePoint Server instances; verify exact version applicability and cumulative update status in the official Microsoft security advisory and your deployment documentation.

Exploitability

This vulnerability is not yet listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been publicly reported or confirmed at the time of publication. However, XSS flaws are among the most frequently exploited web application vulnerabilities, and the low attack complexity combined with the user-interaction requirement makes this a natural target for phishing and social engineering campaigns. No weaponized proof-of-concept code is known to be widely available.

Remediation

Apply security updates from Microsoft as soon as they become available. Prioritize patching internet-facing or externally-accessible SharePoint instances. Implement web application firewalls (WAF) rules to detect and block common XSS payloads. Enforce Content Security Policy (CSP) headers on SharePoint sites to limit script execution. Educate users to avoid clicking unfamiliar links and to verify sender legitimacy before interacting with sensitive SharePoint content.

Patch guidance

Check the Microsoft Security Update Guide and relevant SharePoint Server cumulative update releases published after the vulnerability's modification date (July 9, 2026). Apply patches in a staged manner—test in non-production environments first, then deploy to production during scheduled maintenance windows. Verify patch applicability to your specific SharePoint version and build number before deployment. Monitor SharePoint logs post-patch for any related incident activity.

Detection guidance

Look for HTTP requests containing script tags, JavaScript event handlers (onclick, onerror, onload), or URL-encoded payloads in SharePoint query parameters and form submissions. Monitor for unusual spikes in 4xx or 5xx errors that may indicate WAF rule triggers or failed injection attempts. Enable SharePoint audit logging to track access to sensitive lists and document libraries. Use network-based intrusion detection signatures targeting reflected XSS patterns. Correlate user login times with suspicious file accesses or outbound connections initiated from compromised sessions.

Why prioritize this

Although the CVSS score is medium (5.4), organizations should prioritize this vulnerability because XSS in collaboration platforms has outsized business impact: attackers can impersonate internal users, harvest credentials through spoofing, and gain persistent access to sensitive collaborative content. The lack of KEV listing does not indicate low risk—it reflects a lag in active exploitation reporting. SharePoint's role as a central repository for organizational IP makes it a high-value target. Patching should begin immediately after testing, particularly for externally-accessible instances.

Risk score, explained

The CVSS 3.1 score of 5.4 (Medium) reflects: (1) network attack vector—exploitable remotely without special network conditions; (2) low attack complexity—no special setup required; (3) no privilege requirement—unauthenticated users can trigger the flaw; (4) user interaction required—victims must click or visit a malicious link; (5) impact limited to confidentiality and integrity (low), with no availability impact. The score does not account for business context—financial data exposure, reputational harm, or the strategic value of SharePoint in your organization—so adjust risk prioritization upward if your deployment hosts sensitive information or is customer-facing.

Frequently asked questions