Cross-site scripting in Microsoft SharePoint Server - CVE-2026-88209
Published: October 14, 2026
Vulnerability identifier: #VU155398
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-88209
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform spoofing.
The vulnerability exists due to improper neutralization of input during web page generation in Microsoft Office SharePoint when generating web content. A remote user can supply input that is not properly neutralized to perform spoofing.
Exploitation requires user interaction. The Preview Pane is not an attack vector.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-88209
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20190