CVE-2026-88208: Microsoft Office SharePoint Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Other sources
Microsoft Office SharePoint Spoofing Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.20326.20190Patch KB5002927
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authorized in SharePoint. Exploitation can be performed over the network and does not require high attack complexity.
Does exploitation require a victim to interact with attacker-controlled content?
Yes. The supplied CVSS vector indicates that user interaction is required.
What is the expected security impact?
The vulnerability is associated with spoofing and has low confidentiality and integrity impact in the supplied CVSS assessment. No availability impact is indicated.