CVE-2026-47638 Overview
CVE-2026-47638 is a stored cross-site scripting (XSS) vulnerability affecting Microsoft Office SharePoint Server. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An authenticated attacker can inject malicious script content that executes in the browser context of other SharePoint users, enabling spoofing attacks over the network.
The vulnerability requires user interaction and low-privileged authentication to exploit. Successful exploitation crosses a security boundary, allowing the attacker to affect resources beyond the vulnerable component. Microsoft published the advisory on June 9, 2026.
Critical Impact
An authorized attacker can inject malicious script content into SharePoint pages and perform spoofing attacks against other users of the platform.
Affected Products
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server 2016 Enterprise
Discovery Timeline
- 2026-06-09 - CVE-2026-47638 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-47638
Vulnerability Analysis
The vulnerability resides in SharePoint Server's web page generation logic. SharePoint fails to properly neutralize attacker-supplied input before rendering it within HTML output returned to clients. This allows an authenticated user with low privileges to embed script content into a SharePoint resource that subsequent visitors will load and execute.
When a target user opens the affected page, the injected script runs under the SharePoint origin in the victim's browser. The attacker can use this primitive to impersonate the SharePoint application, present spoofed interface elements, or capture interactions intended for the legitimate site. The scope change indicates the impact extends to components beyond the SharePoint web front end itself.
Exploitation requires the attacker to hold a valid SharePoint account and convince a target user to interact with the malicious content. The network attack vector means any user reachable through the SharePoint application is a potential target.
Root Cause
The root cause is missing or insufficient output encoding when SharePoint renders user-controllable fields into HTML responses. Input that should be treated as data is instead interpreted as executable markup by the browser, classifying the issue under [CWE-79].
Attack Vector
An authenticated attacker submits crafted input containing script payloads into a SharePoint field or component that does not sanitize HTML metacharacters. SharePoint stores or reflects that input into a page served to other users. When a victim loads the page, the browser parses and executes the injected script in the SharePoint security context.
No verified proof-of-concept code is publicly available for this CVE. Refer to the Microsoft CVE-2026-47638 Advisory for vendor technical details.
Detection Methods for CVE-2026-47638
Indicators of Compromise
- SharePoint list items, page fields, or web part properties containing HTML tags such as <script>, <img onerror=...>, or javascript: URIs.
- Unusual outbound requests from user browsers to attacker-controlled domains immediately after loading SharePoint pages.
- Authenticated SharePoint sessions performing unexpected actions consistent with hijacked tokens or spoofed UI prompts.
Detection Strategies
- Review SharePoint ULS logs and audit logs for anomalous edits to list items, pages, and web parts containing markup characters.
- Inspect Content Security Policy (CSP) violation reports from SharePoint front ends for script-source violations.
- Hunt for credential prompts or download dialogs rendered from SharePoint origins that do not match legitimate workflows.
Monitoring Recommendations
- Monitor authenticated user activity that writes to SharePoint fields known to render rich content, especially from accounts created or elevated recently.
- Alert on browser telemetry showing script execution from SharePoint pages that contacts non-Microsoft domains.
- Track failed and successful authentication attempts following user visits to suspect SharePoint URLs to detect downstream session abuse.
How to Mitigate CVE-2026-47638
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-47638 Advisory to all SharePoint Server 2016, 2019, and Subscription Edition farms.
- Audit recently modified SharePoint content for embedded script markup and remove malicious entries.
- Review SharePoint permissions and remove unnecessary contribute-level access from non-essential accounts.
Patch Information
Microsoft has released security updates for SharePoint Server 2016 Enterprise, SharePoint Server 2019, and SharePoint Server Subscription Edition. Administrators should consult the Microsoft CVE-2026-47638 Advisory for the specific KB articles and build numbers that apply to each supported version.
Workarounds
- Restrict SharePoint contribute and edit permissions to trusted users until patches are deployed.
- Enforce a strict Content Security Policy at reverse proxy or load balancer level to limit inline script execution on SharePoint origins.
- Educate users to avoid clicking unexpected links to internal SharePoint pages and report suspicious page content to security teams.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
