Microsoft SharePoint Server: Cross-site scripting leading to privilege escalation
Summary
A cross-site scripting flaw (CWE-79) in Microsoft SharePoint Server Subscription Edition allows an authorized attacker to elevate privileges over the network. Per the supplied vector, the attacker needs a low-privilege account and a user must interact, for example by loading a crafted page. NVD lists a CVSS score of 9.0 (Critical), while Microsoft rates the issue as Important; the vendor score must be verified. No exploitation is known.
Affected
- Microsoft SharePoint Server Subscription Edition: 16.0.0 to before 16.0.20326.20278
- Office Online Server is not listed as affected.
- SharePoint Online and Microsoft 365 are not affected.
Fixed in
- Fix: KB 5002945 for SharePoint Server Subscription Edition (identical to the November 2026 cumulative update for SE)
- Fixed build number: Unknown. Check the KB article or the MSRC entry.
- Farms at the September 2025 CU may need folder permissions corrected before the fix installs.
Workaround
- No vendor workaround is known. Patching is the required fix for supported SE farms.
- Limit contribute/edit rights on broadly shared sites.
- Do not expose SharePoint directly to the internet.
Exploitation
- In the wild: Unknown for this CVE. No CISA KEV entry or vendor exploitation statement was found.
- Public proof of concept: Unknown. None was found.
- Other SharePoint CVEs in 2026 were actively exploited; these are different CVEs.
Our recommendation
- Check whether any client runs SharePoint Server SE on-premises. If not, this CVE does not apply.
- Compare the farm build with the fixed build in the MSRC entry and install KB 5002945.
- Review contribute/edit permissions and disable internet exposure where not required.
- Re-check the MSRC entry and NVD for CVSS changes and KEV status.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Microsoft Office SharePoint
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Microsoft Office
- Updates (KB)
- KB5002945
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-80095 msrc.microsoft.com
- Stefan Gossner: SharePoint security fixes November 2026 PU blog.stefan-gossner.com
- Resecurity: July 2026 SharePoint attacks www.resecurity.com
- CERT-EU security advisory 2026-009 cert.europa.eu
- CISA: SharePoint hardening after new exploitations www.cisa.gov
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 20:48.
Original description (NVD)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.