CVE-2026-47637 Overview
CVE-2026-47637 is a stored cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An authenticated attacker with low privileges can inject script content that executes in another user's browser session. Successful exploitation enables spoofing over a network and requires user interaction with the malicious content.
The vulnerability affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. Microsoft published the advisory through the Microsoft Security Response Center (MSRC).
Critical Impact
An authenticated attacker can inject script content into SharePoint pages, enabling spoofing attacks against other users and a scope change that crosses security boundaries.
Affected Products
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server 2016 Enterprise
Discovery Timeline
- 2026-06-09 - CVE-2026-47637 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-47637
Vulnerability Analysis
The vulnerability resides in the SharePoint Server input handling pipeline. SharePoint fails to neutralize attacker-controlled content before rendering it in dynamically generated web pages. When a victim loads the affected page, the browser executes the injected payload in the context of the SharePoint origin.
The scope change in the CVSS vector indicates that exploitation impacts components beyond the vulnerable SharePoint component. Confidentiality and integrity impacts are limited because the attacker operates within the victim's browser session rather than gaining direct server access. The attack does not affect availability.
Exploitation requires the attacker to hold an authenticated, low-privilege account on the SharePoint instance. The targeted user must interact with the malicious content for the payload to fire.
Root Cause
The root cause is improper output encoding of user-supplied input rendered into HTML responses [CWE-79]. SharePoint accepts content from authorized users and emits it into web pages without contextual encoding suitable for the rendering context (HTML body, attribute, or script).
Attack Vector
An authenticated attacker submits crafted content through a SharePoint input vector — for example a list item, page property, or comment field. SharePoint stores the payload and serves it to other users who visit the affected resource. The victim's browser parses the injected markup or script, which executes with the privileges of the victim's SharePoint session. The attacker can then forge UI elements, capture data, or impersonate trusted SharePoint content to perform spoofing.
No verified proof-of-concept code is publicly available. Refer to the Microsoft Security Update Guide for vendor-supplied technical details.
Detection Methods for CVE-2026-47637
Indicators of Compromise
- SharePoint list items, page fields, or comments containing <script>, javascript: URIs, or HTML event handler attributes such as onerror and onload.
- Unexpected outbound requests from user browsers to attacker-controlled domains following SharePoint page loads.
- Authenticated user sessions performing actions inconsistent with normal user behavior, such as unexpected content edits or credential prompts.
Detection Strategies
- Review SharePoint Unified Logging Service (ULS) logs and audit logs for content modifications by low-privilege accounts targeting shared pages and lists.
- Inspect content stored in SharePoint content databases for HTML tags and JavaScript constructs in fields that should contain plain text.
- Correlate SharePoint authentication events with subsequent content submissions to identify accounts injecting markup at scale.
Monitoring Recommendations
- Enable SharePoint auditing for item updates, page edits, and web part modifications across all site collections.
- Forward SharePoint and IIS logs to a centralized SIEM and alert on payload patterns indicative of script injection.
- Monitor browser-side Content Security Policy (CSP) violation reports for blocked inline scripts originating from SharePoint pages.
How to Mitigate CVE-2026-47637
Immediate Actions Required
- Apply the security update referenced in the Microsoft Security Update Guide for each affected SharePoint Server version.
- Audit recently modified SharePoint content for unexpected HTML or script payloads and remove malicious entries.
- Review accounts with contributor or editor permissions and revoke access that is no longer required.
Patch Information
Microsoft has published patch guidance through the Microsoft Security Update Guide. Administrators should apply the cumulative update corresponding to their SharePoint Server build: Subscription Edition, SharePoint Server 2019, or SharePoint Server 2016.
Workarounds
- Restrict contribute and edit permissions on SharePoint sites to a minimum set of trusted users until the patch is applied.
- Deploy a strict Content Security Policy at the reverse proxy or web application firewall layer to block inline script execution.
- Enable HTML Field Security settings on SharePoint sites to limit the markup permitted in user-editable fields.
# Configuration example - apply latest SharePoint security update via PowerShell
Get-SPProduct -Local
Install-SPPatch -Patch "<path-to-msrc-update>" -PauseAfterInstall:$false
PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
