CVE-2026-55135: Microsoft SharePoint Server XSS Vulnerability

CVE-2026-55135 Overview

CVE-2026-55135 is a stored cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An authenticated attacker with low privileges can inject script content that executes in the context of another user's browser session, enabling spoofing attacks over the network.

Exploitation requires user interaction, and the scope is changed, meaning injected script can affect resources beyond the vulnerable component. Microsoft rates the issue medium severity, and no public exploit or in-the-wild activity has been reported.

Critical Impact

An authenticated attacker can inject script into SharePoint pages, hijack rendered content, and spoof trusted UI elements to deceive other authorized users.

Affected Products

• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2016 Enterprise
• Microsoft SharePoint Server 2019

Discovery Timeline

• 2026-07-14 - CVE-2026-55135 published to the National Vulnerability Database (NVD)
• 2026-07-16 - Last updated in NVD database
• Vendor advisory - Published by Microsoft via the Microsoft Security Response Center advisory for CVE-2026-55135

Technical Details for CVE-2026-55135

Vulnerability Analysis

The vulnerability resides in how SharePoint Server generates web pages from user-controlled input. SharePoint fails to properly sanitize or encode attacker-supplied content before returning it in HTTP responses. When a victim loads the affected page, the browser interprets injected markup as executable script.

Because the scope is changed, the injected script can reach resources managed by a security authority other than the vulnerable component. This expands the blast radius beyond a single SharePoint site and enables spoofing of authenticated user interface elements, links, and forms rendered to other users.

Root Cause

The root cause is missing or insufficient output encoding on a request or content field that SharePoint later renders in a page. Input that should be treated as data is written to the response as HTML, allowing <script> tags or event handlers to execute. This class of defect is tracked as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Attack Vector

The attack proceeds over the network. An attacker authenticates to SharePoint with at least low-level privileges and submits crafted content into a field that SharePoint later renders without encoding. A separate authorized user must interact with the poisoned page for the script to execute.

Once executed, the payload runs with the victim's session context. Attackers can rewrite page content, present fake authentication prompts, exfiltrate session data accessible to the browser, or perform actions on behalf of the victim within their permission set.

See the Microsoft Vulnerability CVE-2026-55135 advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-55135

Indicators of Compromise

• SharePoint list items, wiki pages, or web part properties containing <script> tags, javascript: URIs, or DOM event handler attributes such as onerror and onload.
• HTTP POST requests to SharePoint content APIs from low-privileged accounts containing HTML or encoded script fragments.
• Outbound browser requests from SharePoint pages to unexpected external hosts, indicating script-driven data exfiltration.

Detection Strategies

• Inspect SharePoint IIS logs for requests to content editing endpoints from low-privilege accounts that submit oversized or HTML-laden payloads.
• Deploy a web application firewall (WAF) rule set that flags stored input containing script tags, on*= handlers, or javascript: URIs targeting SharePoint paths.
• Correlate SharePoint audit events for content modification with subsequent page views by privileged users to identify potential victim exposure.

Monitoring Recommendations

• Enable SharePoint audit logging for item creation, modification, and access on collaboration-heavy sites.
• Forward IIS, SharePoint ULS, and endpoint browser telemetry to a centralized SIEM for cross-source correlation.
• Monitor Content Security Policy (CSP) violation reports from browsers rendering SharePoint pages to detect script execution attempts.

How to Mitigate CVE-2026-55135

Immediate Actions Required

• Apply the security update referenced in the Microsoft advisory for CVE-2026-55135 to all affected SharePoint Server deployments.
• Inventory SharePoint Server 2016, 2019, and Subscription Edition farms to confirm patch coverage across all Web Front End servers.
• Review recent content submissions from low-privilege users on public or heavily trafficked sites for injected script.

Patch Information

Microsoft has published a security update through the Microsoft Security Response Center. Administrators should install the update on every SharePoint Server in the farm, including Web Front End and Application servers, and restart affected services per Microsoft guidance. Refer to the MSRC entry for CVE-2026-55135 for the specific KB identifier applicable to each SharePoint version.

Workarounds

• Restrict content contribution permissions on sensitive SharePoint sites to trusted users only, reducing the attacker population able to submit payloads.
• Enforce a strict Content Security Policy at the reverse proxy or load balancer to block inline script execution on SharePoint responses.
• Enable browser-side XSS protections and disable HTML rendering in list fields where plain text is sufficient.

# Configuration example: enforce a restrictive CSP header at the reverse proxy
# (adjust source lists to match your SharePoint deployment)
add_header Content-Security-Policy "default-src 'self'; \
  script-src 'self'; \
  object-src 'none'; \
  base-uri 'self'; \
  frame-ancestors 'self'; \
  report-uri /csp-report" always;