CVE-2026-45465 Overview
CVE-2026-45465 is a stored cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server. The flaw results from improper neutralization of user-supplied input during web page generation [CWE-79]. An authenticated attacker with low privileges can inject malicious script content that executes in the context of other users' browsers when they load affected SharePoint pages.
Successful exploitation enables spoofing attacks over the network. The attack requires user interaction, and the scope is changed, meaning the injected payload can affect resources beyond the originally vulnerable component.
Critical Impact
An authenticated attacker can inject persistent script content into SharePoint pages, enabling spoofing of trusted UI elements and limited disclosure or modification of data accessible to victims who view the affected content.
Affected Products
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2016 Enterprise
- Microsoft SharePoint Server 2019
Discovery Timeline
- 2026-06-09 - CVE-2026-45465 published to the National Vulnerability Database (NVD)
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-45465
Vulnerability Analysis
The vulnerability stems from insufficient input sanitization in SharePoint Server's web page generation logic. Server-side code accepts attacker-controlled input and reflects or stores it within HTML responses without properly encoding active script delimiters or event handler attributes.
When a victim loads the resulting page, the embedded payload executes within the SharePoint origin. Because SharePoint typically serves authenticated, business-critical content, script execution in this context can manipulate the rendered page, capture session-bound data, or present spoofed interface elements.
The attack vector is network-based and requires the attacker to hold a valid, low-privilege SharePoint account. User interaction from the victim is required — typically navigating to or rendering the page containing the injected payload. The changed scope indicates the payload can affect data or functionality beyond the immediate SharePoint component, such as browser-level resources or other trusted origins exposed through the SharePoint UI.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. SharePoint's rendering pipeline does not consistently apply output encoding or context-aware escaping to fields that accept rich or structured input. Attacker-controlled values reach the HTML response in a form that the browser parses as executable script.
Attack Vector
An authenticated attacker submits crafted input through a SharePoint feature that stores or reflects content — for example, list items, web part properties, or page metadata. The payload is persisted or echoed back in subsequent page renders. When a privileged user views the page, the script executes under the SharePoint origin and performs spoofing actions, such as forging notifications, prompts, or redirects that appear to originate from the trusted server.
No verified public exploit code is available for CVE-2026-45465 at the time of publication. Refer to the Microsoft CVE-2026-45465 Advisory for vendor technical details.
Detection Methods for CVE-2026-45465
Indicators of Compromise
- SharePoint list items, page fields, or web part properties containing <script>, javascript:, or HTML event handler attributes such as onerror= and onload=.
- Unexpected outbound requests from user browsers to attacker-controlled domains immediately after loading SharePoint pages.
- Authenticated SharePoint sessions performing unusual content modifications shortly before reports of spoofed UI or phishing prompts.
Detection Strategies
- Review SharePoint Unified Logging Service (ULS) and audit logs for content edits from low-privilege accounts that include HTML or script syntax in user-supplied fields.
- Inspect IIS request logs for POST requests to SharePoint list, page, and web part endpoints containing encoded or raw script payloads.
- Deploy Content Security Policy (CSP) violation reporting on the SharePoint web front ends and alert on report submissions from internal SharePoint origins.
Monitoring Recommendations
- Monitor for newly created or modified SharePoint items by accounts with no prior history of editing the affected lists or pages.
- Track repeated viewing of attacker-modified pages by privileged users such as site collection administrators.
- Correlate browser security telemetry with SharePoint authentication events to identify script-driven actions performed from victim sessions.
How to Mitigate CVE-2026-45465
Immediate Actions Required
- Apply the security update referenced in the Microsoft CVE-2026-45465 Advisory to all SharePoint Server Subscription Edition, 2019, and 2016 deployments.
- Audit recent edits to SharePoint lists, pages, and web parts for HTML or script content and remove malicious entries.
- Restrict contributor and editor permissions to the minimum set of users required for business operations.
Patch Information
Microsoft has published guidance and a security update for CVE-2026-45465 through the Microsoft Security Response Center. Administrators should consult the Microsoft CVE-2026-45465 Advisory for the specific cumulative update or security patch applicable to each supported SharePoint Server version and apply it through standard SharePoint patching procedures, including running the SharePoint Products Configuration Wizard or PSConfig after binary installation.
Workarounds
- Enforce a strict Content Security Policy on SharePoint web applications to limit inline script execution and restrict script sources.
- Disable or constrain SharePoint features that allow rich HTML input from low-privilege users where business requirements permit.
- Require multi-factor authentication for all SharePoint accounts to reduce the pool of attackers able to meet the authenticated precondition.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
