CVE-2026-57105: Microsoft SharePoint Server XSS Vulnerability

CVE-2026-57105 Overview

CVE-2026-57105 is a stored cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An authorized attacker with low privileges can inject malicious script content that executes in a victim's browser, enabling spoofing attacks across the network.

Exploitation requires user interaction and results in a scope change, meaning injected scripts can affect resources beyond the vulnerable SharePoint component. Microsoft published the advisory through the Microsoft Security Response Center (MSRC).

Critical Impact
An authenticated attacker can inject script content into SharePoint pages to spoof trusted UI, hijack sessions, or steal information from users who view the tampered content.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft Office SharePoint (on-premises deployments)

Discovery Timeline

2026-08-11 - CVE-2026-57105 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-57105

Vulnerability Analysis

The vulnerability resides in SharePoint's web page generation logic. SharePoint fails to properly neutralize user-controllable input before including it in server-generated HTML output. When a victim loads the affected page, the browser parses attacker-supplied content as executable script rather than data.

Because the CVSS scope is changed, injected script executes in a security context different from the vulnerable component. This allows the attacker to reach browser resources and session state that would normally be isolated from the SharePoint application. The confidentiality and integrity impacts remain limited, and there is no direct availability impact.

Successful exploitation enables spoofing over a network. An attacker can render forged UI elements, redirect users to attacker-controlled destinations, or perform actions in the victim's session context.

Root Cause

The root cause is missing or insufficient output encoding of user-supplied strings inside a SharePoint rendering path. Input reaches an HTML sink without being encoded for the appropriate context, such as HTML body, attribute, or JavaScript. This is a classic instance of [CWE-79] Improper Neutralization of Input During Web Page Generation.

Attack Vector

The attack vector is network-based and requires an authenticated user with low privileges on the SharePoint site. The attacker submits crafted content through a SharePoint feature that persists or reflects that input in a rendered page. A separate victim, typically a higher-privileged user or another site member, must load the page containing the payload for the script to execute.

No verified proof-of-concept code is publicly available at the time of publication. Refer to the Microsoft CVE-2026-57105 Update for vendor technical details.

Detection Methods for CVE-2026-57105

Indicators of Compromise

SharePoint list items, wiki pages, or document metadata containing HTML <script> tags, javascript: URIs, or unusual event handler attributes such as onerror, onload, or onmouseover.
Outbound requests from user browsers to unfamiliar domains immediately after loading SharePoint pages.
Anomalous session activity from SharePoint users, including unexpected permission changes or content edits made shortly after viewing a page.

Detection Strategies

Inspect SharePoint content stores and audit logs for user-submitted fields containing HTML or script syntax, focusing on fields not expected to hold markup.
Deploy a web application firewall (WAF) with rules targeting XSS payload patterns in POST bodies and query strings sent to SharePoint endpoints.
Correlate SharePoint ULS logs with reverse-proxy access logs to identify submissions that inject markup into rendered pages.

Monitoring Recommendations

Enable SharePoint auditing for content modifications, including list item edits, page updates, and web part configuration changes.
Monitor authenticated SharePoint sessions for unusual navigation patterns, cookie access, or credential re-prompts after page loads.
Forward SharePoint and IIS logs to a centralized analytics platform to enable retroactive hunting for XSS payloads once new indicators are published.

How to Mitigate CVE-2026-57105

Immediate Actions Required

Apply the security update referenced in the Microsoft CVE-2026-57105 Update advisory to all affected SharePoint Server instances.
Inventory SharePoint Server Subscription Edition and SharePoint Server 2019 deployments to confirm patch coverage across farms.
Review site collection permissions and remove unnecessary contributor or author access to reduce the pool of accounts capable of injecting content.

Patch Information

Microsoft has released updates for the affected SharePoint Server versions. Administrators should consult the Microsoft CVE-2026-57105 Update advisory for the specific build numbers and installation guidance corresponding to their environment.

Workarounds

Restrict content contribution rights on SharePoint sites to trusted users until patches are deployed.
Configure a Content Security Policy (CSP) at the reverse-proxy or gateway layer to limit inline script execution on SharePoint responses.
Enable HTML field security settings on custom SharePoint lists to strip or encode markup submitted by users.

bash

# Example: enforce a restrictive CSP header on a reverse proxy fronting SharePoint
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'" always;