CVE-2026-70355 Overview
CVE-2026-70355 is a stored cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server. An authenticated attacker can inject malicious script into SharePoint-generated web pages because user-supplied input is not properly neutralized during page generation [CWE-79]. When a targeted user renders the affected page, the script executes in that user's browser context and enables privilege elevation across a network scope change. The flaw affects Microsoft SharePoint Server Subscription Edition and SharePoint Server 2019.
Critical Impact
An authorized network attacker can execute script in a victim's SharePoint session, elevate privileges, and pivot to compromise site content and user identities served by SharePoint.
Affected Products
- Microsoft SharePoint Server Subscription Edition
- Microsoft SharePoint Server 2019
- SharePoint deployments exposing user-authored content to other authenticated users
Discovery Timeline
- 2026-08-11 - CVE-2026-70355 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-70355
Vulnerability Analysis
CVE-2026-70355 is a cross-site scripting flaw classified under [CWE-79]. SharePoint fails to neutralize attacker-supplied input rendered into web pages served to other users. Because the vulnerability changes scope, script executed under one user context can affect resources controlled by a different security authority within the SharePoint site collection. Successful exploitation compromises confidentiality and integrity of the affected content. The EPSS probability is 0.418%.
Root Cause
The root cause is improper output encoding during web page generation. SharePoint renders attacker-controlled content — such as list items, web part properties, or metadata fields — into HTML without applying context-appropriate escaping. Browsers then interpret the injected payload as executable script rather than inert data.
Attack Vector
The attack requires an authenticated attacker with low privileges on the target SharePoint site and user interaction from a victim. The attacker stores a crafted payload in a SharePoint field that is later rendered to other users. When a privileged user views the page, the payload executes in their browser and can issue authenticated requests, harvest session tokens, or manipulate SharePoint content on the victim's behalf.
No public proof-of-concept exploit code is available. See the Microsoft CVE-2026-70355 Update Guide for vendor technical details.
Detection Methods for CVE-2026-70355
Indicators of Compromise
- SharePoint list items, page fields, or web part properties containing <script>, javascript:, or event-handler attributes such as onerror= and onload=.
- Unexpected outbound requests from user browsers to attacker-controlled domains originating from SharePoint page loads.
- Anomalous privilege changes, permission grants, or content edits performed shortly after a user viewed an untrusted SharePoint page.
Detection Strategies
- Inspect SharePoint content databases and Unified Logging Service (ULS) logs for stored payloads containing script tags or encoded script vectors.
- Correlate IIS logs for SharePoint front-end servers with browser-side referrers to identify pages triggering suspicious outbound calls.
- Monitor Microsoft 365 audit logs for permission grants immediately following a page render by a privileged account.
Monitoring Recommendations
- Alert on new or modified SharePoint items where field content matches XSS heuristic patterns before rendering.
- Track authentication token reuse from unusual IP addresses following SharePoint page access by administrators.
- Review site collection administrator and Full Control assignments for changes not tied to an approved workflow.
How to Mitigate CVE-2026-70355
Immediate Actions Required
- Apply the security update referenced in the Microsoft CVE-2026-70355 Update Guide to SharePoint Server Subscription Edition and SharePoint Server 2019.
- Restrict contributor and edit permissions on internet-facing or broadly shared SharePoint sites until the patch is installed.
- Audit recent list, page, and web part changes for injected script content and remove any confirmed payloads.
Patch Information
Microsoft has issued a security update for CVE-2026-70355. Administrators should install the update through the standard SharePoint patching process, apply Configuration Wizard steps on each server in the farm, and verify build numbers on all Web Front End and Application servers. Refer to the vendor advisory for the specific KB numbers and cumulative update packages.
Workarounds
- Enforce least privilege by removing unnecessary contribute or design rights from SharePoint site users.
- Enable and enforce a strict Content Security Policy at the reverse proxy or load balancer fronting SharePoint to limit inline script execution.
- Require administrators to use a dedicated browser profile or privileged access workstation when accessing SharePoint sites containing user-generated content.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
