CVE-2026-47634 Overview
CVE-2026-47634 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server. The flaw stems from improper neutralization of input during web page generation [CWE-79], allowing an authenticated attacker to inject script content that executes in another user's browser session. Successful exploitation enables spoofing over a network. The vulnerability requires user interaction and low-privilege authentication, and it crosses a security scope boundary because the injected script runs in the victim's authenticated SharePoint context. Microsoft published guidance through the Microsoft Security Response Center on June 9, 2026.
Critical Impact
An authenticated attacker can inject malicious script into SharePoint pages, leading to spoofing, session manipulation, and exposure of confidential information rendered in the victim's browser.
Affected Products
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2019
- On-premises SharePoint deployments exposing affected web rendering endpoints
Discovery Timeline
- 2026-06-09 - CVE-2026-47634 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-47634
Vulnerability Analysis
The vulnerability resides in SharePoint Server's web page generation logic, which fails to properly neutralize user-controllable input before reflecting it into rendered HTML. The weakness is classified as both improper neutralization of special elements in output [CWE-74] and reflected or stored cross-site scripting [CWE-79]. An authenticated attacker with low privileges can submit crafted input through a SharePoint surface that accepts user content, such as list items, page properties, or web part configurations. When another user views the affected page, the browser executes the attacker-controlled script under the SharePoint origin. Because the scope changes during exploitation, the script can affect resources beyond the attacker's original privilege boundary, enabling spoofing of trusted UI elements and forged actions on behalf of the victim. Exploitation requires the victim to interact with the malicious content, typically by navigating to a poisoned page. No public proof-of-concept code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Root Cause
SharePoint's rendering pipeline does not consistently apply contextual output encoding to attacker-supplied strings before embedding them in HTML, attribute, or JavaScript contexts. This gap allows script payloads to break out of their intended data context and execute as code in the victim's session.
Attack Vector
The attack is delivered over the network against an authenticated SharePoint site. The attacker stores or reflects a script payload through an authorized input channel and then lures a privileged user to view the affected resource. The injected script runs with the victim's SharePoint permissions, enabling spoofed content, forged requests, and disclosure of session-bound data.
No verified proof-of-concept code is available for CVE-2026-47634.
Refer to the Microsoft Security Response Center advisory for technical details.
Detection Methods for CVE-2026-47634
Indicators of Compromise
- SharePoint list items, page fields, or web part properties containing <script>, javascript:, or HTML event handler attributes such as onerror= and onload=.
- Unexpected outbound requests from SharePoint user sessions to attacker-controlled domains shortly after viewing internal pages.
- IIS or SharePoint ULS log entries showing repeated POSTs to content edit endpoints from low-privilege accounts followed by views from privileged users.
Detection Strategies
- Inspect SharePoint content databases and recent list item revisions for HTML payloads containing executable script constructs.
- Correlate authentication logs with content modification events to flag low-privilege accounts authoring content viewed by administrators.
- Deploy Content Security Policy (CSP) reporting endpoints to surface script execution that violates expected SharePoint origins.
Monitoring Recommendations
- Monitor wss_content database changes and SharePoint audit logs for high-volume edits to user-editable fields.
- Alert on browser-side CSP violations originating from SharePoint URLs.
- Track anomalous use of SharePoint REST and CSOM APIs by accounts that do not typically author content.
How to Mitigate CVE-2026-47634
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-47634 Update advisory to all affected SharePoint Server instances.
- Audit recently modified SharePoint content for embedded script payloads and remove or sanitize suspicious entries.
- Restrict content authoring permissions to trusted users and review delegated permissions on sensitive sites.
Patch Information
Microsoft has released security updates for SharePoint Server Subscription Edition and SharePoint Server 2019. Administrators should consult the Microsoft Security Response Center advisory for the specific update packages applicable to each supported version and apply them through standard patch management workflows.
Workarounds
- Enforce a strict Content Security Policy on SharePoint web applications to limit inline script execution.
- Disable custom script support on sites that do not require it using Set-SPOSite -DenyAddAndCustomizePages equivalents for on-premises configurations.
- Require multi-factor authentication for SharePoint accounts to raise the cost of authenticated exploitation paths.
# Disable custom script on SharePoint on-premises web applications
Stsadm.exe -o setproperty -pn allowhtmlsccripting -pv false -url https://sharepoint.example.com
# Verify the latest security update is installed
Get-SPProduct | Where-Object { $_.ProductName -like "*SharePoint*" } | Select-Object ProductName, PatchableUnitDisplayName, Patches
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
