Cross-site scripting in Microsoft SharePoint Server - CVE-2026-88204
Published: October 14, 2026
Vulnerability identifier: #VU155394
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-88204
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to access or modify SharePoint data available to another user.
The vulnerability exists due to cross-site scripting in SharePoint page content rendering when generating web pages containing user-supplied content. A remote user can store malicious script content in a page to access or modify SharePoint data available to another user.
Exploitation requires permission to add or modify page content and another user to view and interact with the affected content. The script runs in that user's security context. The Preview Pane is not an attack vector.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-88204
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20190