CVE-2026-45467: SharePoint XSS Vulnerability

CVE-2026-45467 Overview

CVE-2026-45467 is a stored or reflected cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An authenticated attacker with low privileges can inject script content that executes in the context of another SharePoint user's browser session. Successful exploitation enables spoofing attacks over the network and requires victim interaction such as clicking a crafted link or visiting a poisoned page.

Critical Impact
An authorized attacker can inject script into SharePoint pages and impersonate trusted UI elements to deceive other users, leading to credential theft or unauthorized actions performed in the victim's session.

Affected Products

Microsoft Office SharePoint (specific versions enumerated in the Microsoft Security Update Guide)
SharePoint Server deployments processing untrusted user input in web page generation
SharePoint environments accessible to authenticated low-privilege users over a network

Discovery Timeline

2026-06-09 - CVE-2026-45467 published to the National Vulnerability Database
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45467

Vulnerability Analysis

The vulnerability resides in SharePoint's handling of user-controlled input that flows into rendered web pages. SharePoint fails to properly sanitize or encode characters that carry meaning in HTML and JavaScript contexts. When the affected component generates a page containing this attacker-controlled content, the browser interprets the payload as executable script rather than data.

The attack requires authentication and low privileges, meaning any user with basic SharePoint access can submit a payload. Exploitation requires a victim to interact with the malicious content, typically by viewing a crafted SharePoint resource. The scope is unchanged, and the impact is limited to confidentiality and integrity at a low level with no direct availability impact.

Because SharePoint frequently hosts business documents, lists, and collaboration content, an injected script can manipulate the rendered interface to spoof legitimate prompts, harvest session tokens, or trick users into approving unintended actions.

Root Cause

The root cause is missing or insufficient output encoding when SharePoint reflects user input into HTML responses. Input that should be treated as inert text reaches the response stream with HTML and JavaScript metacharacters intact, allowing browsers to parse and execute attacker-supplied markup.

Attack Vector

The attack vector is network-based. An authenticated attacker submits a crafted payload through a SharePoint input field, list entry, document property, or URL parameter. A second user with access to the same SharePoint site then loads the page containing the payload, and the script executes within that user's authenticated browser session. The attacker can then forge content to spoof trusted elements of the SharePoint interface.

No verified exploit code is publicly available. See the Microsoft Security Update Guide for CVE-2026-45467 for vendor-supplied technical details.

Detection Methods for CVE-2026-45467

Indicators of Compromise

SharePoint list items, document metadata, or page fields containing HTML tags such as <script>, <img onerror=...>, or javascript: URI schemes
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after loading SharePoint pages
Anomalous session token reuse from unfamiliar IP addresses following a SharePoint browsing event

Detection Strategies

Review SharePoint ULS logs and IIS access logs for requests containing encoded script payloads in query strings or POST bodies
Hunt for SharePoint content fields containing HTML control characters (<, >, ", ') in places that should hold plain text
Correlate authenticated user input submissions with subsequent page views by other users to identify potential XSS delivery chains

Monitoring Recommendations

Enable verbose auditing on SharePoint list and document modifications to capture payload submissions
Forward SharePoint and web proxy logs to a centralized analytics platform to support cross-source correlation
Alert on Content Security Policy (CSP) violation reports originating from SharePoint hostnames

How to Mitigate CVE-2026-45467

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-45467 to all affected SharePoint servers
Inventory SharePoint deployments and verify patch status across farms, including development and staging environments
Restrict contributor and edit permissions on SharePoint sites to the minimum required user set

Patch Information

Microsoft has issued an official update through the Microsoft Security Update Guide. Administrators should consult the Microsoft Security Update for CVE-2026-45467 for build numbers, KB identifiers, and deployment guidance specific to each supported SharePoint version.

Workarounds

Enforce a strict Content Security Policy on SharePoint web applications to limit inline script execution
Review and remove custom SharePoint web parts or scripts that bypass default HTML encoding routines
Educate users to avoid clicking unexpected SharePoint links and to report spoofed prompts requesting credentials

bash

# Example: list SharePoint farm build to confirm patch level (PowerShell)
Get-SPFarm | Select-Object BuildVersion
Get-SPProduct -Local