Microsoft SharePoint Server: Cross-site scripting enabling spoofing
Summary
Microsoft SharePoint Server Subscription Edition (on-premises) contains a vulnerability classified as cross-site scripting (CWE-79). Microsoft describes the impact as spoofing by an authorized attacker over the network. The attacker needs a low-privilege account, and a user must interact, for example by opening a crafted link or page. Confidentiality and integrity are rated high, and availability is not affected.
Affected
- SharePoint Server Subscription Edition (on-premises), 16.0.0 before 16.0.20326.20278 (x64)
- Other SharePoint editions: Unknown.
Fixed in
- Build 16.0.20326.20278 (November 2026 cumulative update for SharePoint Server Subscription Edition)
- KB5002945 according to a third-party source; verify with the vendor KB page.
Workaround
No workaround published. Install the patch.
- Before installing on a farm running the September 2025 CU, run Fix-SeptemberCU-Permission-Problem.ps1 to correct folder permissions, otherwise the fixes can fail.
Exploitation
- No evidence of exploitation in the wild; not listed in KEV.
- Exploit code maturity is 'Unproven' (E:U); no public proof of concept found.
Our recommendation
- Inventory on-premises SharePoint farms and confirm edition and build.
- Prioritise farms that are internet-facing or serve external users.
- Check for the September 2025 CU permission issue and run the script if needed.
- Install the November 2026 CU (16.0.20326.20278) or KB5002945.
- Verify against the MSRC advisory and monitor NVD and KEV for updates. Also patch CVE-2026-120002 in the same release.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Spoofing – Microsoft Office SharePoint
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Microsoft Office
- Updates (KB)
- KB5002945
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE.org record CVE-2026-110065 www.cve.org
- MSRC Security Update Guide msrc.microsoft.com
- Stefan Gossner: SharePoint security fixes released with November 2026 PU blog.stefan-gossner.com
- Stefan Gossner: November 2026 CU for SharePoint Server Subscription Edition blog.stefan-gossner.com
- Strix: CVE-2026-110065 www.strix.ai
- Automox: Patch Tuesday November 2026 www.automox.com
- Strix: CVE-2026-120002 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:31.
Original description (NVD)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.