CVE-2026-55030: Microsoft SharePoint Server XSS Vulnerability

CVE-2026-55030 Overview

CVE-2026-55030 is a stored cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An authenticated attacker with low privileges can inject malicious script content that executes in the browser context of another SharePoint user. Successful exploitation enables spoofing attacks against victim users over the network. The vulnerability requires user interaction, such as clicking a crafted link or viewing a poisoned SharePoint page. Microsoft published the advisory on July 14, 2026, affecting SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016.

Critical Impact
An authorized attacker can inject script content into SharePoint pages to spoof trusted UI elements, hijack sessions, or trick users into disclosing credentials in the context of a trusted SharePoint site.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2026-07-14 - Microsoft publishes security advisory for CVE-2026-55030
2026-07-14 - CVE-2026-55030 published to the National Vulnerability Database
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-55030

Vulnerability Analysis

The vulnerability is a cross-site scripting flaw in Microsoft SharePoint Server. SharePoint fails to properly sanitize or encode user-supplied input before rendering it in dynamically generated HTML pages. When a victim loads the affected page, the attacker-controlled payload executes in the security context of the SharePoint origin.

Because the payload runs within the trusted SharePoint domain, it can read Document Object Model (DOM) content, manipulate page elements, and issue requests using the victim's session. The scope is marked as changed, meaning the injected script can affect resources beyond the initially vulnerable component. This behavior enables convincing spoofing attacks, including forged login prompts and fake administrative dialogs.

Exploitation requires an attacker to hold a valid SharePoint account with permission to submit content. It also requires a target user to interact with the poisoned content, such as opening a list item, document, or crafted URL.

Root Cause

The root cause is missing or insufficient output encoding in one or more SharePoint web rendering paths. Input received from an authenticated user is stored or reflected into HTML responses without contextual escaping. Standard XSS defenses, such as HTML entity encoding and attribute-context encoding, are not consistently applied before content reaches the browser.

Attack Vector

The attack vector is network-based and requires low privileges plus user interaction. An authenticated attacker submits crafted input containing HTML or JavaScript into a SharePoint field, list, wiki page, or comment. When a second user views the affected resource, the injected script executes with the victim's session cookies and SharePoint permissions. The attacker can then impersonate the victim, spoof authentic SharePoint UI, or exfiltrate sensitive information visible to that user. No proof-of-concept exploit code is currently published for this vulnerability. Refer to the Microsoft Security Update CVE-2026-55030 advisory for technical details.

Detection Methods for CVE-2026-55030

Indicators of Compromise

SharePoint list items, pages, or comments containing HTML tags such as <script>, <img onerror=>, or <svg onload=> in fields that should hold plain text.
Unexpected outbound requests from user browsers to attacker-controlled domains originating from SharePoint page contexts.
Anomalous session activity, such as permission changes or content edits performed by users who did not knowingly initiate the actions.

Detection Strategies

Review SharePoint Unified Logging Service (ULS) logs and audit logs for content submissions containing script tags, event handler attributes, or encoded JavaScript payloads.
Deploy web application firewall (WAF) rules that inspect SharePoint POST bodies for XSS signatures, including javascript: URIs and DOM event handlers.
Correlate authenticated user submissions with subsequent browser-generated requests to identify script execution patterns.

Monitoring Recommendations

Enable SharePoint auditing for item creation, modification, and page edits across all site collections.
Monitor Content-Security-Policy (CSP) violation reports if CSP is deployed in report-only or enforcing mode.
Alert on user accounts making bulk edits to list items or pages that include HTML markup outside their normal behavior baseline.

How to Mitigate CVE-2026-55030

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-55030 to all affected SharePoint Server instances as documented in the Microsoft Security Update Guide.
Audit SharePoint user permissions and remove content-contribution rights from accounts that do not require them.
Review recent content submissions for embedded HTML or JavaScript payloads and remove suspicious entries.

Patch Information

Microsoft has released a security update addressing CVE-2026-55030 for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Administrators should install the update through Microsoft Update, Windows Server Update Services (WSUS), or by downloading the packages directly from the Microsoft Security Update Guide. Verify patch application on all farm servers, including Web Front-End and Application servers.

Workarounds

Deploy a strict Content-Security-Policy header on SharePoint responses to restrict inline script execution where compatible with your customizations.
Configure a WAF in front of SharePoint to block requests containing XSS payloads in form fields and query parameters.
Restrict the ability to author HTML in list fields by enabling plain-text-only settings on user-editable columns where feasible.

bash

# Example: Query SharePoint patch status via PowerShell
Get-SPFarm | Select-Object BuildVersion
Get-SPProduct -Local | Select-Object ProductName, PatchableUnitDisplayName, Patches