CVE-2026-88204: Microsoft Office SharePoint Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Other sources
Microsoft Office SharePoint Spoofing Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.20326.20190Patch KB5002927
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authorized to access the affected Microsoft SharePoint Server Subscription Edition environment. Exploitation is performed over the network and requires user interaction.
What is the likely impact if exploitation succeeds?
The issue is classified as spoofing and involves cross-site scripting during web page generation. The provided severity vector indicates high confidentiality and integrity impact, with no availability impact.
Is there evidence that exploitation is occurring or that public exploit code is available?
The supplied data rates exploit maturity as unknown. It does not state that exploitation has been observed or that public exploit code is available.