CVE-2026-88209: Microsoft Office SharePoint Spoofing Vulnerability
Published Oct 13, 2026
·Updated
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Other sources
Microsoft Office SharePoint Spoofing Vulnerability
— Microsoft
Affected Software
1 affected componentFixes available
Microsoft SharePoint Server Subscription Edition<16.0.20326.20190
16.0.20326.20190
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.20326.20190Patch KB5002927
Event History
Oct 13, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
DescriptionSeverity
Frequently Asked Questions
1
What access and conditions does an attacker need?
The attacker must be authorized and able to reach the affected SharePoint Server Subscription Edition instance over the network. Exploitation also requires user interaction.
2
What is the likely impact of successful exploitation?
Successful exploitation allows spoofing. The provided severity vector indicates low confidentiality and integrity impact, with no availability impact.