Microsoft SharePoint Server: Cross-site scripting leading to spoofing
Summary
A cross-site scripting (XSS) flaw in Microsoft SharePoint Server Subscription Edition (on-premises) allows an authorized attacker to inject script into web pages, which Microsoft classifies as a spoofing issue. The attacker needs a low-privilege account and the victim must interact, for example by opening a crafted page or link. Microsoft's CVE record scores confidentiality and integrity impact as high, so the impact is more than cosmetic. No exploitation or public exploit code has been found so far.
Affected
- Microsoft SharePoint Server Subscription Edition (on-premises), versions 16.0.0 to before 16.0.20326.20278
- SharePoint Online and other SharePoint versions are not listed as affected
Fixed in
- Build 16.0.20326.20278 or later (to be verified against the Microsoft advisory)
- Update: November 2026 security update, KB 5002945 (per third-party blog, to be verified)
Workaround
Unknown. No workaround has been published; apply the update.
Exploitation
- Exploited in the wild: no evidence found; not listed in CISA KEV at time of research
- Public proof-of-concept: none found
- CISA SSVC: exploitation none, automatable no, technical impact total
- Note: a separate SharePoint spoofing flaw was added to CISA KEV in April 2026; it is not this CVE
Our recommendation
- Confirm whether you run SharePoint Server Subscription Edition on-premises and which build is installed
- Install the November 2026 security update (KB 5002945) promptly, especially if the farm is published externally
- Before installing, check the official Microsoft guidance for any prerequisite steps for farms at the September 2025 CU level
- Review the CISA KEV catalog and NVD once analysis is complete
- If you do not run this product, no action is needed beyond confirming your inventory
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Spoofing – Microsoft Office SharePoint
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Microsoft Office
- Updates (KB)
- KB5002945
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide msrc.microsoft.com
- CVE Record CVE-2026-109497 www.cve.org
- Stefan Gossner blog: SharePoint November 2026 security fixes blog.stefan-gossner.com
- Strix CVE-2026-109497 www.strix.ai
- Cybersecurity Dive: SharePoint exploitation (separate flaw) www.cybersecuritydive.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:32.
Original description (NVD)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.