CVE-2026-64902: Microsoft SharePoint Server XSS Vulnerability

CVE-2026-64902 Overview

CVE-2026-64902 is a stored cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server. The flaw stems from improper neutralization of user-supplied input during web page generation, tracked under [CWE-79]. An authenticated attacker with low privileges can inject malicious script content that executes in the browser context of other SharePoint users, enabling spoofing attacks across a network. Successful exploitation requires user interaction, such as viewing a crafted page or item. Microsoft rates this vulnerability at 5.4 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating a scope change where injected script affects components beyond the vulnerable SharePoint instance.

Critical Impact
An authorized attacker can inject scripts into SharePoint pages, spoofing trusted content and manipulating other users' browser sessions within the SharePoint domain.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2026-08-11 - CVE-2026-64902 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-64902

Vulnerability Analysis

CVE-2026-64902 is a cross-site scripting vulnerability [CWE-79] in Microsoft Office SharePoint Server. SharePoint fails to properly sanitize input before including it in dynamically generated web pages. An authenticated user with permission to submit content, such as list items, wiki pages, or metadata, can embed script payloads that execute when other users render the affected page.

Because SharePoint operates as a collaboration platform where users routinely consume content published by peers, XSS payloads propagate through normal workflows. The scope change reflected in the CVSS vector indicates that the injected script can influence resources beyond the vulnerable SharePoint web application, including the browser's same-origin context for related services.

The primary impact is spoofing. Attackers can rewrite page content, forge notifications, harvest session tokens exposed to script, or trigger unauthorized actions on behalf of the victim within the SharePoint domain.

Root Cause

The vulnerability originates in SharePoint code paths that render user-controlled input without applying context-appropriate output encoding. HTML, attribute, or JavaScript contexts each require distinct encoding schemes, and missing or inconsistent sanitization allows script tags or event handler attributes to survive into the rendered DOM.

Attack Vector

The attack requires network access to the SharePoint site and low-privileged authenticated access. The attacker submits crafted content containing script payloads into a SharePoint feature that stores or reflects the input. A subsequent victim, who must interact with the malicious content by opening the affected page or item, triggers execution of the payload in their authenticated session context.

No verified proof-of-concept code is publicly available for this vulnerability. Refer to the Microsoft Security Update CVE-2026-64902 advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-64902

Indicators of Compromise

SharePoint list items, pages, or metadata fields containing <script> tags, javascript: URIs, or unusual event handler attributes such as onerror, onload, or onmouseover.
Unified Logging System (ULS) entries showing content submissions with HTML markup from low-privileged accounts to sensitive site collections.
Outbound browser requests from SharePoint users to attacker-controlled domains immediately after loading a SharePoint page.
Anomalous session token usage or API calls to SharePoint originating from user sessions shortly after page views.

Detection Strategies

Inspect SharePoint content databases and list item history for HTML or JavaScript payloads submitted through fields expected to contain plain text.
Deploy web application firewall (WAF) rules to flag XSS payload signatures in POST requests to SharePoint endpoints such as _layouts, _api, and _vti_bin.
Correlate authentication events with content modification events to identify low-privileged accounts injecting markup into shared pages.
Monitor browser telemetry for Content Security Policy (CSP) violation reports originating from SharePoint domains.

Monitoring Recommendations

Enable and centralize SharePoint ULS logs and IIS request logs into a SIEM for correlation and retention.
Alert on modifications to high-traffic SharePoint pages, site templates, and web parts by non-administrator accounts.
Baseline expected content patterns per site collection and flag deviations that contain script or iframe markup.

How to Mitigate CVE-2026-64902

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-64902 advisory to all affected SharePoint Server instances.
Inventory SharePoint Server 2016 Enterprise, 2019, and Subscription Edition deployments and prioritize internet-facing farms.
Review recent content submissions from low-privileged accounts for embedded HTML or script payloads and remove malicious content.
Rotate any session tokens or credentials that may have been exposed to users who viewed compromised pages.

Patch Information

Microsoft has published a security update through the Microsoft Security Response Center. Administrators should consult the Microsoft Security Update CVE-2026-64902 advisory for the specific KB article and cumulative update applicable to each SharePoint Server edition. Apply updates using standard SharePoint patching procedures, including running the SharePoint Products Configuration Wizard after installation.

Workarounds

Restrict content contribution permissions on sensitive site collections until patches are applied, limiting who can submit HTML-capable content.
Enforce a strict Content Security Policy at the reverse proxy or load balancer to reduce script execution capability on SharePoint pages.
Enable browser XSS protections and require modern browsers with strong isolation features for SharePoint access.
Audit and disable custom web parts or add-ins that render user input without server-side encoding.

bash

# Example: enforce HTTP response headers on SharePoint via IIS to limit XSS impact
Add-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST/SharePoint - 80' -filter "system.webServer/httpProtocol/customHeaders" -name "." -value @{name='Content-Security-Policy';value="default-src 'self'; script-src 'self'; object-src 'none'"}
Add-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST/SharePoint - 80' -filter "system.webServer/httpProtocol/customHeaders" -name "." -value @{name='X-Content-Type-Options';value='nosniff'}