SB2026101486 - Multiple vulnerabilities in Microsoft Office SharePoint

Description

This security bulletin contains information about 3 vulnerabilities.

1) Missing Authorization (CVE-ID: CVE-2026-88164)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to missing authorization in Microsoft Office SharePoint when handling requests. A remote user can send a specially crafted request to perform operations beyond their account permissions to escalate privileges.

No additional user interaction is required. The Preview Pane is not an attack vector.

2) Cross-site scripting (CVE-ID: CVE-2026-97783)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to perform spoofing and execute scripts in the security context of the current user.

The vulnerability exists due to improper neutralization of input in Microsoft SharePoint Server when generating web pages. A remote attacker can entice a user to click a link that triggers cross-site scripting to perform spoofing and execute scripts in the security context of the current user.

3) Observable discrepancy (CVE-ID: CVE-2026-97782)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to alter trusted application state and cause unauthorized backend actions.

The vulnerability exists due to an observable discrepancy in Microsoft SharePoint forms when processing submitted session data. A remote user can submit specially crafted session data through an affected form to alter trusted application state and cause unauthorized backend actions.

Successful exploitation requires a deep understanding of the system and manipulation of its components to trigger a specific condition. User interaction is not required.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88164
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97783
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-97782