CVE-2026-97783: Microsoft Office SharePoint Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Other sources
Microsoft Office SharePoint Spoofing Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.19725.20434Patch KB5002882 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.10417.20175Patch KB5002883 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.5561.1001Patch KB5002891
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability is remotely reachable and does not require the attacker to be authenticated. Exploitation does require user interaction.
What security impact is indicated?
The issue is classified as spoofing and involves cross-site scripting during web page generation. The supplied severity vector indicates high impacts to confidentiality and integrity, with no availability impact.
Which product is identified as affected?
The provided affected software entry identifies Microsoft SharePoint Server 2019.