CVE-2026-64922: Microsoft SharePoint Server XSS Vulnerability

CVE-2026-64922 Overview

CVE-2026-64922 is a stored cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An authenticated attacker with low privileges can inject script content that executes in the context of another user's browser session, enabling spoofing over a network. Successful exploitation requires user interaction, such as viewing a crafted SharePoint page or artifact. Microsoft rates the issue as medium severity based on limited confidentiality and integrity impact and a scope change beyond the vulnerable component.

Critical Impact
An authenticated attacker can inject malicious script into SharePoint content to spoof trusted UI, hijack sessions, or steal data rendered to victim users.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2026-08-11 - CVE-2026-64922 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-64922

Vulnerability Analysis

The vulnerability is a cross-site scripting flaw in Microsoft Office SharePoint's web page generation logic. SharePoint fails to properly sanitize or encode attacker-controlled input before rendering it into HTML responses returned to other users. When a victim loads the affected page, the injected payload runs in the victim's browser under the SharePoint site origin. Because the scope changes across a security boundary, the executed script can influence resources beyond the initial vulnerable component. The primary impact is spoofing: the attacker can present fraudulent content, mimic legitimate SharePoint interfaces, or perform actions on behalf of the victim.

Root Cause

SharePoint accepts input from an authenticated low-privilege user and stores or reflects it into an HTML page without applying context-appropriate output encoding. Fields that permit rich content, hyperlinks, or embedded markup are the likely injection sinks. The rendering pipeline treats attacker-supplied fragments as trusted markup, allowing <script> execution or event-handler injection when a victim views the resource.

Attack Vector

Exploitation occurs over the network and requires the attacker to hold a valid low-privilege SharePoint account. The attacker submits a crafted payload through a SharePoint input surface such as a list item, comment, document property, or page component. A second user with equal or higher privilege must interact with the injected content for the payload to execute. Script execution in the victim's session enables session token theft, forged requests, and visual spoofing of SharePoint dialogs or workflows.

No public proof-of-concept exploit code is available for CVE-2026-64922. Refer to the Microsoft CVE-2026-64922 Advisory for authoritative technical details.

Detection Methods for CVE-2026-64922

Indicators of Compromise

SharePoint list items, comments, or page fields containing <script> tags, javascript: URIs, or DOM event handlers such as onerror and onmouseover.
Unexpected outbound requests from SharePoint client browsers to attacker-controlled domains carrying cookie or token data in URL parameters.
Audit log entries showing repeated content edits by low-privilege accounts targeting shared sites, wikis, or announcements.

Detection Strategies

Inspect SharePoint content databases and recent edits for HTML markup that bypasses the standard rich-text filter.
Deploy web application firewall (WAF) rules that flag XSS payload patterns submitted to _layouts, _api, and list endpoints.
Correlate SharePoint audit logs with browser telemetry to identify users who rendered suspicious content authored by low-privilege accounts.

Monitoring Recommendations

Enable SharePoint diagnostic logging and forward events to a centralized SIEM for retention and correlation.
Alert on anomalous document property changes and mass edits performed by non-administrative accounts.
Monitor authentication logs for session reuse from unexpected IP addresses following interaction with edited SharePoint pages.

How to Mitigate CVE-2026-64922

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-64922 Advisory to all affected SharePoint Server instances.
Inventory SharePoint Server 2016, 2019, and Subscription Edition farms and confirm patch status across all web front-end servers.
Review recent content contributions by low-privilege users and remove any pages, list items, or attachments containing script markup.

Patch Information

Microsoft has published guidance and updates for CVE-2026-64922 through the Microsoft Security Response Center. Administrators should install the vendor-supplied cumulative or security update for the specific SharePoint Server edition in use. Consult the Microsoft CVE-2026-64922 Advisory for build numbers and installation prerequisites.

Workarounds

Restrict content contribution rights to trusted user groups until patching is complete.
Enforce a strict Content Security Policy (CSP) on SharePoint sites to limit inline script execution.
Educate users to avoid interacting with unexpected SharePoint pages, links, or embedded content from low-privilege authors.

bash

# Example: audit recent SharePoint content changes via PowerShell
Get-SPSite -Limit All | ForEach-Object {
    $_.RootWeb.Lists | Where-Object { $_.LastItemModifiedDate -gt (Get-Date).AddDays(-7) } |
        Select-Object Title, LastItemModifiedDate, ItemCount
}