SB20260812237 - Cross-site scripting in Microsoft SharePoint Server

Description

This security bulletin contains information about 1 vulnerability.

1) Cross-site scripting (CVE-ID: CVE-2026-70306)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to perform spoofing.

The vulnerability exists due to cross-site scripting in web page generation in Microsoft Office SharePoint when handling a specially crafted URL and form submission. A remote attacker can send a specially crafted URL and persuade an authenticated SharePoint user to visit it and submit the form to perform spoofing.

Successful exploitation can run script in the victim's SharePoint session, potentially accessing information or modifying site content. User interaction is required.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70306
• https://support.microsoft.com/help/5002882