Cross-site scripting in Microsoft SharePoint Server - CVE-2026-111303
Published: November 11, 2026
Vulnerability identifier: #VU164801
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-111303
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to spoof web content and access or modify sensitive information.
The vulnerability exists due to improper neutralization of input during web page generation in Microsoft Office SharePoint when rendering user-supplied content. A remote user can supply crafted content that executes script in a victim's browser when the victim interacts with it to spoof web content and access or modify sensitive information.
The Preview Pane is not an attack vector for this vulnerability.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-111303
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20278