CVE-2026-33113 Overview
CVE-2026-33113 is a stored or reflected cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An authorized attacker can inject script content that executes in the context of another user's session, enabling spoofing attacks over the network.
The issue requires user interaction to trigger and impacts confidentiality and integrity at a limited scope. Microsoft published advisory information through the Microsoft Security Response Center.
Critical Impact
An authenticated attacker can craft SharePoint content that runs arbitrary script in a victim's browser, allowing spoofing of trusted UI elements and theft of session context.
Affected Products
- Microsoft Office SharePoint (see vendor advisory for specific build numbers)
Discovery Timeline
- 2026-06-09 - CVE-2026-33113 published to the National Vulnerability Database
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-33113
Vulnerability Analysis
The vulnerability is a cross-site scripting flaw in Microsoft Office SharePoint. SharePoint renders user-controllable data into HTML responses without sufficient output encoding. When a victim loads the affected page, the injected payload executes in the browser under the SharePoint origin.
Exploitation requires the attacker to hold a valid SharePoint account with permission to submit content to a location another user will view. The victim must then interact with the affected page, which triggers the script payload. Because the script runs under the SharePoint origin, attackers can spoof page contents, fabricate prompts, or perform actions that misrepresent legitimate site behavior.
The impact is bounded to limited confidentiality and integrity loss with no direct availability impact. Spoofing scenarios include presenting falsified document content, fake login overlays, or manipulated workflow approvals to authenticated users.
Root Cause
The root cause is missing or incomplete output encoding when SharePoint serializes attacker-controlled fields into the HTML response. Input that should be HTML-escaped or rejected reaches the page-generation path unchanged, allowing script tags or event handlers to render as executable markup.
Attack Vector
The attack vector is network-based. An authenticated attacker submits crafted content — such as list items, page text, web part properties, or document metadata — containing a script payload. When a targeted user views the page, the browser parses and executes the payload. EPSS data places the exploitation probability at approximately 0.059% as of 2026-06-11.
No verified proof-of-concept code is published for this CVE. Refer to the Microsoft Security Update CVE-2026-33113 advisory for vendor technical details.
Detection Methods for CVE-2026-33113
Indicators of Compromise
- SharePoint list items, page fields, or web part configurations containing <script>, javascript:, or HTML event handler attributes such as onerror= and onload=
- Outbound browser requests from authenticated SharePoint sessions to attacker-controlled domains shortly after a user opens a SharePoint page
- Unexpected modifications to SharePoint content by non-administrative accounts immediately prior to user reports of spoofed UI
Detection Strategies
- Audit SharePoint content stores for fields containing HTML or script syntax outside of approved rich-text contexts
- Enable and review SharePoint ULS logs and Microsoft 365 audit logs for suspicious ItemAdded and ItemUpdated events from low-privilege users
- Deploy browser-side Content Security Policy (CSP) violation reporting and alert on inline-script violations originating from SharePoint origins
Monitoring Recommendations
- Monitor user-reported anomalies such as unexpected prompts, redirects, or credential dialogs on SharePoint pages
- Correlate SharePoint authentication logs with anomalous session token use from new IP addresses following page views
- Track edits to high-traffic SharePoint pages and document libraries by accounts that historically do not author content
How to Mitigate CVE-2026-33113
Immediate Actions Required
- Apply the security update referenced in the Microsoft Security Update CVE-2026-33113 advisory to all affected SharePoint servers
- Inventory SharePoint sites and identify accounts with content contribution rights to high-visibility pages
- Review recent content changes for injected script or HTML payloads and remove them before patching completes
Patch Information
Microsoft has published a security update for CVE-2026-33113. Administrators should consult the Microsoft Security Update CVE-2026-33113 advisory for the specific patch package, supported builds, and installation guidance.
Workarounds
- Restrict contribution and edit permissions on SharePoint sites to trusted users until the patch is deployed
- Enforce a strict Content Security Policy on SharePoint front-end traffic to limit inline script execution
- Disable custom scripting on self-service created sites using Set-SPOSite -DenyAddAndCustomizePages for SharePoint Online tenants
- Educate users to avoid interacting with unfamiliar SharePoint content and to report unexpected prompts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
