CVE-2026-55126 Overview
CVE-2026-55126 is a stored cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server. The flaw arises from improper neutralization of user-supplied input during web page generation [CWE-79]. An authenticated attacker can inject script content that executes in a victim's browser session, enabling spoofing over a network. Exploitation requires low privileges and user interaction, and the impact crosses a security scope boundary.
Microsoft published the advisory on July 14, 2026, and the entry was last updated on July 16, 2026. No public proof-of-concept code or in-the-wild exploitation has been reported at time of writing.
Critical Impact
Authenticated attackers can inject malicious script into SharePoint pages to spoof content, hijack sessions, or trick users into disclosing credentials.
Affected Products
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2019
- Microsoft SharePoint Server 2016 Enterprise
Discovery Timeline
- 2026-07-14 - CVE-2026-55126 published to NVD
- 2026-07-14 - Microsoft releases security update via MSRC
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-55126
Vulnerability Analysis
The vulnerability resides in SharePoint Server's handling of user-controlled input rendered into web pages. SharePoint fails to properly encode or sanitize input before it is reflected or stored in HTML output. An authenticated user with permission to submit content, such as list items, page fields, or metadata, can embed script payloads that execute in the browser context of subsequent viewers.
Because the scope changes upon successful exploitation, the injected script runs with the privileges of the victim's session against the SharePoint origin. This allows an attacker to perform spoofing actions, manipulate rendered content, exfiltrate session cookies not protected by HttpOnly, and issue requests on behalf of the victim.
User interaction is required. A victim must load the crafted page or component containing the malicious payload.
Root Cause
The root cause is missing or insufficient output encoding when SharePoint composes HTML from attacker-controlled input fields. Input intended as display text is treated as active markup, allowing <script> tags or event handler attributes to execute during page rendering.
Attack Vector
The attack vector is network-based. An authenticated attacker with at least contributor-level permissions on a SharePoint site submits a payload into an affected input surface. When another user, including a privileged account, views the affected resource, the browser parses and executes the injected script within the SharePoint domain.
The vulnerability manifests through unsanitized input rendered into HTML output. Refer to the Microsoft Security Update CVE-2026-55126 advisory for vendor technical details.
Detection Methods for CVE-2026-55126
Indicators of Compromise
- SharePoint list items, page content, or metadata fields containing HTML tags such as <script>, <img onerror=>, or <svg onload=>.
- Outbound browser requests from SharePoint sessions to unfamiliar external domains carrying cookie or token data.
- Unexpected modifications to SharePoint pages, web parts, or list items performed by low-privilege accounts.
Detection Strategies
- Inspect SharePoint content databases and site audit logs for input fields containing HTML or JavaScript syntax.
- Correlate authenticated user submissions with subsequent anomalous browser activity from other users viewing the same resource.
- Deploy web application firewall rules that flag script tags and event handler attributes within SharePoint POST bodies.
Monitoring Recommendations
- Enable SharePoint audit logging for item creation, edit, and view events on high-value sites.
- Monitor Microsoft 365 Defender and Unified Audit Log for anomalous SharePoint content changes tied to standard user accounts.
- Alert on browser-side Content Security Policy (CSP) violations reported by SharePoint pages.
How to Mitigate CVE-2026-55126
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-55126 to SharePoint Server Subscription Edition, 2019, and 2016.
- Review contributor and site owner permissions and remove unnecessary write access on public-facing sites.
- Audit recently modified list items, pages, and web parts for embedded script content.
Patch Information
Microsoft addressed CVE-2026-55126 through its standard update channel. Administrators should install the latest cumulative update for their SharePoint Server version as documented in the Microsoft Security Update CVE-2026-55126 advisory. Verify installation across all farm servers, including front-end web servers and application servers.
Workarounds
- Enforce a strict Content Security Policy on SharePoint sites to restrict inline script execution.
- Restrict content contribution permissions to trusted user groups until patching is complete.
- Educate SharePoint authors to avoid using rich text fields that permit raw HTML input where possible.
# Verify installed SharePoint patch level on a farm server
Get-SPProduct | Select-Object ProductName, PatchableUnitDisplayName, LatestPatch
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
