Cross-site scripting in Microsoft SharePoint Server - CVE-2026-70306
Published: August 12, 2026
Vulnerability identifier: #VU142001
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-70306
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform spoofing.
The vulnerability exists due to cross-site scripting in web page generation in Microsoft Office SharePoint when handling a specially crafted URL and form submission. A remote attacker can send a specially crafted URL and persuade an authenticated SharePoint user to visit it and submit the form to perform spoofing.
Successful exploitation can run script in the victim's SharePoint session, potentially accessing information or modifying site content. User interaction is required.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-70306
Install security update from vendor's website.
Microsoft SharePoint Server - addressed in versions 16.0.5561.1001, 16.0.10417.20175, 16.0.19725.20434