CVE-2026-55021: Microsoft SharePoint Server XSS Vulnerability

CVE-2026-55021 Overview

CVE-2026-55021 is a stored cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server. The flaw stems from improper neutralization of user-supplied input during web page generation, classified as [CWE-79]. An authenticated attacker with low privileges can inject malicious script content that executes in the context of another user's browser session. Successful exploitation enables spoofing attacks across the network and impacts both the confidentiality and integrity of affected SharePoint deployments. Microsoft published the advisory on July 14, 2026, covering SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise.

Critical Impact
Authenticated attackers can inject scripts that execute against other users, enabling session-context spoofing, credential theft, and unauthorized actions across SharePoint sites.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2026-07-14 - CVE-2026-55021 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-55021

Vulnerability Analysis

The vulnerability exists in SharePoint's server-side rendering pipeline, where user-controlled input is embedded into generated HTML without adequate encoding. Because SharePoint hosts a wide range of user-contributable surfaces such as list items, page fields, and web part properties, injected script payloads persist server-side and execute when other users load the affected page. The scope change indicates the injected content escapes SharePoint's security boundary and executes against a broader context, which is why the impact extends to spoofing of privileged sessions. Exploitation requires the attacker to hold a valid SharePoint account and requires user interaction from the victim, typically loading or previewing the tampered content.

Root Cause

The root cause is missing or insufficient output encoding when SharePoint composes HTML from stored user input. Fields that should be treated as untrusted text are rendered as active markup, allowing <script> tags, event handlers, or JavaScript URIs to be interpreted by the browser. This is a classic [CWE-79] pattern where sanitization is applied inconsistently across code paths handling the same content.

Attack Vector

The attack is network-reachable and requires authentication. An attacker with contributor-level access submits crafted input, such as list item titles, comments, or web part configuration values, containing script payloads. When a targeted SharePoint user, often an administrator or coworker, opens the containing page, the browser executes the injected script within the SharePoint origin. The script can then impersonate the victim, submit unauthorized requests, exfiltrate SharePoint content, or manipulate displayed data to spoof legitimate communications.

No public proof-of-concept code is available at the time of publication. See the Microsoft Security Update CVE-2026-55021 advisory for vendor technical details.

Detection Methods for CVE-2026-55021

Indicators of Compromise

SharePoint list items, comments, or page fields containing <script> tags, javascript: URIs, or inline event handlers such as onerror and onload.
Unexpected outbound requests from user browsers to attacker-controlled domains immediately after loading SharePoint pages.
Audit log entries showing content modifications by low-privileged accounts to pages typically accessed by administrators.

Detection Strategies

Inspect SharePoint content databases and audit logs for stored HTML payloads containing script constructs or encoded variants such as <script>.
Deploy Content Security Policy (CSP) reporting on SharePoint origins to surface script execution blocked by policy, which is a strong signal of injection attempts.
Correlate SharePoint page views by privileged users with anomalous browser-initiated network activity to identify session-context spoofing.

Monitoring Recommendations

Enable and forward SharePoint ULS logs and IIS access logs to a centralized analytics platform for query and retention.
Monitor Microsoft 365 Defender and SharePoint audit streams for suspicious modifications to shared pages, wikis, and list items.
Alert on account behavior anomalies where contributor accounts edit content that is subsequently viewed by administrators within a short window.

How to Mitigate CVE-2026-55021

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update CVE-2026-55021 advisory to all affected SharePoint Server installations.
Audit recently created or modified SharePoint content for embedded scripts and remove suspicious entries.
Review contributor and author role assignments and remove access for accounts that do not require content creation privileges.

Patch Information

Microsoft has released fixes as part of the security update tracked under CVE-2026-55021. Administrators should install the update through standard Microsoft update channels for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. Verify patch installation with Get-SPProduct and confirm build numbers match the versions listed in the advisory.

Workarounds

Restrict use of the Allow Contributors to Add or Customize Pages and custom script permissions at the site collection level using Set-SPOsite -DenyAddAndCustomizePages 1.
Enforce a strict Content Security Policy on SharePoint web applications to limit inline script execution.
Require multi-factor authentication for all SharePoint accounts to reduce the value of hijacked sessions.

bash

# Disable custom script on affected site collections until patched
Set-SPOsite -Identity https://contoso.sharepoint.example.com/sites/target -DenyAddAndCustomizePages 1

# Verify SharePoint build to confirm the security update is applied
Get-SPProduct | Select-Object ProductName, PatchableUnitDisplayName, PatchableUnitVersion