CVE-2026-47641 Overview
CVE-2026-47641 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint. The flaw stems from improper neutralization of input during web page generation [CWE-20]. An authenticated attacker can inject script content that executes in a victim's browser session, enabling spoofing attacks across a network.
Microsoft published the advisory in the Microsoft Security Response Center (MSRC) update guide. The vulnerability affects on-premises SharePoint Server editions, including the subscription edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. Successful exploitation requires user interaction, such as clicking a crafted link or rendering attacker-controlled SharePoint content.
Critical Impact
An authenticated attacker can inject malicious script into SharePoint pages to spoof content, impersonate trusted application output, and capture limited confidential and integrity-sensitive data in targeted user sessions.
Affected Products
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server 2016 Enterprise
Discovery Timeline
- 2026-06-09 - CVE-2026-47641 published to the National Vulnerability Database (NVD)
- 2026-06-10 - Last updated in NVD database
- 2026-06-11 - EPSS score recorded at 0.099% (27.098 percentile)
Technical Details for CVE-2026-47641
Vulnerability Analysis
The vulnerability is a stored or reflected cross-site scripting condition in Microsoft Office SharePoint Server. SharePoint fails to neutralize attacker-supplied input before rendering it as part of an HTML response. When the page is rendered in a victim's browser, the injected payload executes in the SharePoint origin context.
Because the scope is changed (S:C), executed script can reach resources beyond the vulnerable component's security authority. This allows an authenticated attacker with low privileges to alter how SharePoint content is displayed to other users. Confidentiality and integrity impacts are limited, and availability is not affected.
The attack class aligns with input validation issues classified under [CWE-20]. SharePoint web parts and list-rendering surfaces are common vectors for injection because they accept rich content from contributors and display it to other site users.
Root Cause
The root cause is missing or insufficient output encoding when SharePoint composes HTML responses from user-controlled fields. Input that should be treated as text is rendered as active script markup, allowing the browser to interpret attacker-supplied content as code.
Attack Vector
The attack is delivered over the network and requires the attacker to hold an authorized SharePoint identity, such as a contributor account. The attacker submits crafted content to a SharePoint surface that is later rendered to other users. A victim must interact with the affected page or a link pointing to it. Once rendered, the payload runs in the victim's SharePoint session and can perform spoofed actions or surface deceptive content.
No verified public exploit code or proof-of-concept is currently available. See the Microsoft Security Update CVE-2026-47641 advisory for vendor technical details.
Detection Methods for CVE-2026-47641
Indicators of Compromise
- SharePoint list items, web part properties, or display name fields that contain <script>, javascript:, onerror=, or onload= payloads
- Unexpected outbound requests from end-user browsers to non-corporate domains immediately after loading a SharePoint page
- ULS log entries showing rendering errors or unusual content in fields associated with affected web parts
Detection Strategies
- Inspect SharePoint content databases and audit logs for HTML or script markup in fields intended to hold plain text
- Apply web application firewall (WAF) signatures that flag XSS payload patterns on SharePoint URIs and POST bodies
- Correlate authenticated user content edits with subsequent anomalous page views to identify likely injection points
Monitoring Recommendations
- Forward IIS, SharePoint ULS, and audit logs to a centralized analytics platform for inspection of edits to list items and pages
- Monitor for new or modified contributor accounts that perform bulk edits across multiple SharePoint sites
- Alert on browser-side Content Security Policy (CSP) violation reports originating from SharePoint hostnames
How to Mitigate CVE-2026-47641
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-47641 to all affected SharePoint Server instances
- Inventory SharePoint Server Subscription Edition, 2019, and 2016 Enterprise deployments to confirm patch coverage
- Review and reduce contributor-level permissions where users do not require content authoring rights
Patch Information
Microsoft has published a security update through the MSRC update guide. Administrators should obtain the patch matching their SharePoint Server build from the Microsoft Security Update CVE-2026-47641 advisory and follow the standard SharePoint patching procedure, including running the SharePoint Products Configuration Wizard after binary installation.
Workarounds
- Enforce a strict Content Security Policy on SharePoint web applications to limit inline script execution
- Restrict the ability to add custom HTML or script-bearing content to a small number of trusted authors
- Educate users to verify links and avoid interacting with unsolicited SharePoint content shared by low-trust accounts
# Example: verify SharePoint farm build after applying the security update
Get-SPFarm | Select-Object BuildVersion
Get-SPProduct -Local | Select-Object ProductName, PatchableUnitDisplayName, Patches
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
