CVE-2026-47640 Overview
CVE-2026-47640 is a stored cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An authenticated attacker with low privileges can inject crafted script content that executes in another user's browser session, enabling spoofing attacks over the network.
The vulnerability requires user interaction and affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Microsoft published the advisory on June 9, 2026.
Critical Impact
Authenticated attackers can inject scripts that execute in victim browsers, leading to UI spoofing, content manipulation, and potential session data exposure across SharePoint sites.
Affected Products
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server 2016 Enterprise
Discovery Timeline
- 2026-06-09 - CVE-2026-47640 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-47640
Vulnerability Analysis
The vulnerability resides in how SharePoint Server processes and renders user-controlled input within web page output. SharePoint fails to properly encode or sanitize input before embedding it into HTML responses. This permits an authenticated attacker to inject JavaScript or HTML payloads that execute when another user loads the affected page.
The attack scope is classified as changed, meaning the injected script can affect resources beyond the vulnerable component. Successful exploitation results in spoofing, where attackers can alter rendered page content, manipulate UI elements, or redirect users to attacker-controlled resources. The vulnerability impacts both confidentiality and integrity at a limited level.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. SharePoint's rendering logic does not consistently apply output encoding to user-supplied fields before placing them into the response HTML. When the browser parses the response, attacker-controlled content is interpreted as executable script rather than inert data.
Attack Vector
The attack vector is network-based and requires the attacker to hold valid low-privilege credentials on the SharePoint instance. The attacker submits a payload through an input field, list item, document property, or similar user-editable surface. A second user with access to the affected page must then load the resource, triggering script execution in the victim's session context.
No verified public proof-of-concept exists at the time of publication. See the Microsoft Security Update CVE-2026-47640 advisory for vendor technical details.
Detection Methods for CVE-2026-47640
Indicators of Compromise
- SharePoint list items, document metadata, or web part properties containing HTML tags such as <script>, <iframe>, or javascript: URI handlers.
- Outbound requests from user browsers to unfamiliar domains immediately after loading SharePoint pages.
- Anomalous modifications to SharePoint content by low-privilege accounts followed by access from privileged users.
Detection Strategies
- Inspect SharePoint content databases and audit logs for input fields containing encoded or raw script tokens, event handlers (onerror, onload), and base64-encoded payloads.
- Deploy Content Security Policy (CSP) reporting endpoints to capture script execution violations originating from SharePoint origins.
- Correlate SharePoint authentication events with subsequent edits to shared content from accounts that do not normally modify those resources.
Monitoring Recommendations
- Enable SharePoint ULS logging and forward events to a centralized SIEM for retention and correlation.
- Monitor edit events on high-visibility pages, wikis, and lists accessible to large user populations.
- Alert on user-agent or referrer anomalies indicating script execution outside expected workflows.
How to Mitigate CVE-2026-47640
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-47640 to all SharePoint Server Subscription Edition, 2019, and 2016 deployments.
- Audit existing SharePoint content for stored payloads injected before patching, focusing on fields editable by low-privilege users.
- Review and reduce contributor-level permissions on sites accessible to broad user populations.
Patch Information
Microsoft has released updates addressing CVE-2026-47640. Refer to the Microsoft Security Update CVE-2026-47640 guidance for build numbers corresponding to each supported SharePoint Server edition. Apply updates through the standard SharePoint patching procedure, including running the SharePoint Products Configuration Wizard after binary installation.
Workarounds
- Restrict content contribution rights on SharePoint sites to trusted users until patches are deployed.
- Configure browser-side Content Security Policy headers to block inline script execution where compatible with SharePoint functionality.
- Enable HTML field security on lists and libraries to limit acceptance of script-bearing content.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
