CVE-2026-45479: SharePoint XSS Vulnerability – Authentication Required, Spoofing Risk

Technical summary

This vulnerability stems from improper input sanitization during web page generation in SharePoint (CWE-79). An authenticated attacker can inject unsanitized input into SharePoint pages, causing malicious JavaScript to execute in the context of other users' browsers. The CVSS 3.1 score of 4.6 reflects the network-exploitable nature, low attack complexity, and requirement for prior authentication plus user interaction. The impact is limited to confidentiality and integrity of the affected user's session; availability is not compromised.

Business impact

SharePoint environments often host sensitive documents, project plans, and internal communications. A successful XSS attack could expose confidential information to unauthorized parties, damage trust in internal systems, or be used as a pivot point for social engineering within the organization. The spoofing capability means attackers can impersonate legitimate SharePoint content, potentially redirecting users to credential harvesting sites or malware distribution channels. Organizations with highly collaborative or public-facing SharePoint instances face elevated risk.

Affected systems

This vulnerability affects Microsoft SharePoint Server. Consult the official Microsoft security advisory for the complete list of affected versions and build numbers. Organizations should audit their SharePoint deployment architecture to identify which servers and site collections are internet-facing or accessible to external authenticated users, as these pose the greatest risk.

Exploitability

Exploitation requires an attacker to possess valid SharePoint credentials and to trick a user into viewing a malicious page or link. The attacker cannot force the victim to interact; user action is mandatory. This requirement significantly lowers the attack surface compared to unauthenticated XSS vulnerabilities. However, in environments where SharePoint guest access or federated authentication is enabled, or where credentials are compromised through other means, this barrier is substantially weakened. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Apply the security update from Microsoft as soon as it becomes available for your affected SharePoint versions. Prioritize patching SharePoint servers that host sensitive content or are accessible to external authenticated users. As an interim mitigation, implement or strengthen Content Security Policy (CSP) headers to limit the scope of injected scripts, restrict guest access if not business-critical, and conduct security awareness training to reduce user susceptibility to phishing and social engineering tactics that leverage XSS payloads.

Patch guidance

Obtain the latest security update from the Microsoft Security Update Guide using the CVE identifier. Apply patches in a staged approach: first to non-production environments for compatibility testing, then to production during a scheduled maintenance window. Verify successful patching by checking installed SharePoint build numbers against the advisory. If your organization uses SharePoint Online (Microsoft 365), updates are applied automatically; verify the update status through your tenant settings. For on-premises deployments, use Windows Server Update Services (WSUS) or manual patch deployment depending on your infrastructure.

Detection guidance

Monitor SharePoint logs and IIS logs for unusual input patterns, HTML entities, or JavaScript keywords in query strings and POST body parameters. Implement Web Application Firewall (WAF) rules to detect and block common XSS payloads. Enable SharePoint audit logging to track document access and page modifications by authenticated users. Use endpoint detection and response (EDR) tools to identify suspicious browser activity following user navigation to SharePoint sites. Search for indicators such as script tags, event handlers, or encoded payloads in web traffic to or from SharePoint servers.

Why prioritize this

Although scored as MEDIUM severity, this vulnerability warrants prompt patching due to its ease of exploitation once an attacker has credentials, the widespread use of SharePoint in enterprise environments, and the potential for lateral movement or data exfiltration. The spoofing capability creates a social engineering vector that is often underestimated. Organizations should treat this with higher priority if they have internet-facing SharePoint or high user populations with access to sensitive collaboration spaces.

Risk score, explained

The CVSS 3.1 base score of 4.6 reflects network accessibility (AV:N), low attack complexity (AC:L), requirement for authenticated access (PR:L), and mandatory user interaction (UI:R). The impact is limited to low-level confidentiality and integrity compromise with no availability impact. This score appropriately captures the technical properties but should be supplemented by environmental risk assessment: organizations with externally shared SharePoint sites or sensitive intellectual property should apply a higher contextual risk rating.

Frequently asked questions