CVE-2026-70306: Microsoft SharePoint Server XSS Vulnerability

CVE-2026-70306 Overview

CVE-2026-70306 is a cross-site scripting (XSS) vulnerability affecting Microsoft Office SharePoint Server. The flaw stems from improper neutralization of input during web page generation [CWE-79]. An unauthorized attacker can exploit the issue over a network to perform spoofing against authenticated SharePoint users. Successful exploitation requires user interaction, such as clicking a crafted link or loading attacker-controlled content within a SharePoint context. Microsoft has published guidance and updates through the Microsoft Security Response Center (MSRC). The scope change reflected in the CVSS vector indicates that exploitation can affect resources beyond the vulnerable component, elevating the impact across the SharePoint site collection.

Critical Impact
Unauthenticated attackers can execute script in the victim's browser session and spoof trusted SharePoint content, enabling credential theft and lateral movement into collaboration workloads.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 Enterprise

Discovery Timeline

2026-08-11 - CVE-2026-70306 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-70306

Vulnerability Analysis

The vulnerability resides in how Microsoft SharePoint Server generates web page output from user-supplied input. SharePoint fails to properly neutralize special characters before reflecting or storing them in rendered HTML. An attacker crafts input containing JavaScript payloads that SharePoint later serves to other users. When a victim loads the affected page, the browser executes the injected script within the SharePoint origin.

The CVSS scope change indicates that script execution in the SharePoint context grants access to resources managed by a different security authority, such as tokens, cookies, and API endpoints tied to the user's identity. Attackers can hijack sessions, submit requests on behalf of the victim, or spoof trusted UI elements to harvest credentials.

Root Cause

The root cause is missing or insufficient output encoding when SharePoint constructs HTML responses that include attacker-controlled data. Input intended as text is instead interpreted as active script by the browser, satisfying the conditions described in [CWE-79].

Attack Vector

Exploitation occurs over the network and requires user interaction. An unauthenticated attacker delivers a malicious URL, email link, or crafted content that a legitimate SharePoint user opens. Upon rendering, the injected payload executes with the victim's SharePoint privileges. Because the flaw involves a scope change, script execution can pivot into linked services, OAuth flows, and downstream Microsoft 365 integrations tied to the compromised session.

No verified public exploit code is available for CVE-2026-70306. See the Microsoft CVE-2026-70306 Update for authoritative technical details.

Detection Methods for CVE-2026-70306

Indicators of Compromise

Inbound HTTP requests to SharePoint endpoints containing <script>, javascript:, onerror=, or encoded variants such as %3Cscript%3E in query parameters or POST bodies.
Unexpected outbound requests from user browsers to attacker-controlled domains immediately after loading SharePoint pages.
Anomalous SharePoint list or page edits containing HTML markup in fields normally holding plain text.
Session cookies or form digests appearing in referer headers or external telemetry.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect SharePoint request parameters for script tags, event handlers, and common XSS obfuscation patterns.
Correlate SharePoint IIS logs with browser-side security events to identify users who loaded suspicious payloads.
Monitor SharePoint audit logs for content modifications from unusual accounts, IP ranges, or user agents.

Monitoring Recommendations

Enable and centralize SharePoint ULS and IIS logging to a SIEM for retention and correlation.
Alert on SharePoint page or list item modifications that include HTML, <script>, or onload attributes.
Track spikes in authentication events, token issuance, or API calls originating from browsers that recently loaded SharePoint URLs shared via email.

How to Mitigate CVE-2026-70306

Immediate Actions Required

Apply the security update referenced in the Microsoft CVE-2026-70306 Update to all affected SharePoint Server instances.
Inventory SharePoint Subscription Edition, 2019, and 2016 deployments and prioritize internet-exposed farms.
Revoke and reissue any session tokens or credentials suspected of exposure during the vulnerability window.
Educate users about clicking SharePoint links from untrusted sources until patching completes.

Patch Information

Microsoft has released updates addressing CVE-2026-70306. Consult the MSRC advisory for the specific KB numbers, cumulative updates, and installation guidance for each affected SharePoint Server edition. Apply updates during a maintenance window and validate site collections after installation.

Workarounds

Restrict SharePoint access to authenticated users through VPN or reverse proxy until patches are deployed.
Enforce strict Content Security Policy (CSP) headers on SharePoint responses to limit inline script execution.
Disable custom scripting on SharePoint sites where business requirements permit using the Set-SPOSite -DenyAddAndCustomizePages setting.
Configure browsers and email gateways to strip or warn on SharePoint URLs containing suspicious query strings.

bash

# Disable custom scripting on SharePoint sites to reduce XSS surface
Set-SPOSite -Identity https://contoso.sharepoint.com/sites/example -DenyAddAndCustomizePages 1