Cross-site scripting in Microsoft SharePoint Server - CVE-2026-97783
Published: October 14, 2026
Vulnerability identifier: #VU155782
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-97783
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform spoofing and execute scripts in the security context of the current user.
The vulnerability exists due to improper neutralization of input in Microsoft SharePoint Server when generating web pages. A remote attacker can entice a user to click a link that triggers cross-site scripting to perform spoofing and execute scripts in the security context of the current user.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-97783
Install security update from vendor's website.