Cross-site scripting in Microsoft SharePoint Server - CVE-2026-80095
Published: November 11, 2026
Vulnerability identifier: #VU165533
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-80095
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges, potentially gaining the administrative privileges of the SharePoint farm service identity.
The vulnerability exists due to improper neutralization of input during web page generation in Microsoft SharePoint Server when rendering user-supplied page content. A remote user can store malicious script on a page they have permission to add or modify, causing it to execute in another user's security context when that user views and interacts with the affected content, potentially allowing access to or modification of SharePoint data available to that user.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-80095
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20278