Cross-site scripting in Microsoft SharePoint Server - CVE-2026-88208
Published: October 14, 2026
Vulnerability identifier: #VU155397
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-88208
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to access or modify SharePoint data available to another user.
The vulnerability exists due to improper neutralization of input during web page generation (cross-site scripting) in SharePoint page content rendering when rendering user-supplied content. A remote user can store malicious scripts in an affected page to access or modify SharePoint data available to another user.
Exploitation requires permission to add or modify content on the affected page. Another user must view and interact with the affected content, causing the script to run in that user's security context.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-88208
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20190