CVE-2026-47639 Overview
CVE-2026-47639 is a stored cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An authenticated attacker can inject script content that executes in the browser context of other SharePoint users, enabling spoofing attacks over the network.
Microsoft assigned a CVSS 3.1 base score of 5.4. Exploitation requires low privileges and user interaction, with a scope change indicating impact beyond the vulnerable component. The current EPSS probability is 0.06%, reflecting low observed exploitation likelihood at this time.
Critical Impact
An authenticated attacker can inject scripts into SharePoint pages that execute in victims' browsers, enabling content spoofing and limited disclosure or tampering of user data.
Affected Products
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server 2016 Enterprise
Discovery Timeline
- 2026-06-09 - CVE-2026-47639 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-47639
Vulnerability Analysis
The vulnerability is a cross-site scripting weakness in SharePoint Server's web page generation logic. SharePoint fails to neutralize attacker-controlled input before reflecting or rendering it into HTML responses. When a victim loads the affected page, the injected payload executes within the SharePoint origin in the victim's browser.
The scope-change attribute indicates the injected script can affect resources beyond the vulnerable component. In practice, this allows an attacker to spoof page content, manipulate the document object model (DOM), or exfiltrate limited session information accessible to scripts running in the SharePoint context.
Exploitation requires the attacker to hold an authenticated SharePoint account with permission to submit content. User interaction is required, meaning a victim must visit or render the malicious content for the payload to fire.
Root Cause
The root cause is missing or insufficient output encoding when SharePoint renders user-supplied strings into HTML. Fields that accept text, links, or rich content do not consistently apply context-aware escaping. Attacker input containing HTML or JavaScript syntax is preserved verbatim and parsed by the browser as executable markup.
Attack Vector
The attack is delivered over the network through standard SharePoint HTTP or HTTPS interfaces. An attacker with at least Contribute-level access injects a crafted payload into a SharePoint field, list item, page, or web part. When another authenticated user views the affected resource, the script executes under the SharePoint domain. This enables spoofing, redirect, and limited data manipulation in the victim's session.
No verified public proof-of-concept is available. See the Microsoft CVE-2026-47639 Advisory for vendor technical details.
Detection Methods for CVE-2026-47639
Indicators of Compromise
- SharePoint list items, page properties, or web part configurations containing HTML tags such as <script>, <img onerror=>, or javascript: URIs in unexpected fields.
- IIS or SharePoint Unified Logging Service (ULS) entries showing POST requests to _api/web/lists or _layouts/15/ endpoints with payloads containing encoded script delimiters.
- Outbound browser requests from authenticated SharePoint sessions to attacker-controlled domains immediately after rendering a SharePoint page.
Detection Strategies
- Inspect SharePoint content databases for stored fields containing script tags, event handlers, or encoded HTML entities introduced by non-administrative accounts.
- Correlate IIS access logs for POST or PUT requests to content APIs with unusually large payloads from low-privilege users, followed by GET requests from other users to the same item.
- Monitor browser-side telemetry from managed endpoints for script execution originating from SharePoint URLs but referencing external script sources.
Monitoring Recommendations
- Forward IIS, ULS, and SharePoint audit logs to a centralized SIEM and alert on content modifications by accounts deviating from baseline behavior.
- Enable SharePoint auditing for editing items, editing users and permissions, and editing content types across all site collections.
- Track anomalous authentication patterns and session token use that follow page rendering events tied to recently modified content.
How to Mitigate CVE-2026-47639
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-47639 Advisory for the affected SharePoint Server edition.
- Audit recently created or modified content from low-privilege accounts and remove items containing script payloads or unexpected HTML.
- Review and tighten Contribute and Edit permissions on site collections accessible to large user populations.
Patch Information
Microsoft has issued security updates for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Administrators should download and deploy the updates through the Microsoft Update Catalog or Windows Server Update Services. Verify patch installation by checking the SharePoint product version after applying cumulative updates and language packs.
Workarounds
- Restrict SharePoint contribution rights to trusted accounts and enforce least privilege on lists, libraries, and pages until patches are deployed.
- Enable a strict Content Security Policy (CSP) at the reverse proxy or load balancer to limit inline script execution from SharePoint responses.
- Require multi-factor authentication for all SharePoint users to reduce the risk of an attacker abusing a compromised low-privilege account.
# Verify SharePoint build version after patching
Get-SPFarm | Select-Object BuildVersion
Get-SPProduct -Local | Select-Object ProductName, PatchableUnitDisplayName, Patches
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
