CVE-2026-64897 in SharePoint Server
Summary
by MITRE • 08/11/2026
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
Cross-site scripting vulnerabilities in Microsoft Office SharePoint represent a critical security weakness that enables authenticated attackers to execute malicious scripts within the context of other users' browsers. This particular vulnerability stems from insufficient input validation and sanitization during web page generation processes, creating an exploitable vector where malicious content can be injected into SharePoint applications. The flaw allows attackers who already possess valid credentials to craft specially crafted payloads that bypass normal security controls and manipulate the application's output rendering mechanisms.
The technical implementation of this XSS vulnerability occurs when SharePoint fails to properly sanitize user-supplied input before incorporating it into dynamically generated web pages. This improper neutralization creates opportunities for attackers to inject malicious scripts that execute in the victim's browser context, potentially leading to session hijacking, data theft, or unauthorized actions performed on behalf of legitimate users. The vulnerability specifically affects the web page generation component where user inputs are processed without adequate filtering or encoding mechanisms.
From an operational perspective, this vulnerability significantly impacts SharePoint environments by enabling attackers to perform spoofing attacks that can deceive users into believing they are interacting with legitimate application interfaces. Attackers can exploit this weakness to create fake login pages, modify displayed content, or redirect users to malicious websites while maintaining the appearance of authentic SharePoint applications. The authenticated nature of the attack means that exploitation requires valid user credentials, but once achieved, the attacker can leverage the trust relationship between the user and the application to execute more sophisticated attacks.
The security implications extend beyond simple script injection as this vulnerability can facilitate broader compromise scenarios including credential theft through session manipulation, privilege escalation opportunities, and data exfiltration. According to CWE standards, this represents a classic cross-site scripting flaw classified under CWE-79 which encompasses improper neutralization of input during web page generation. The attack vector aligns with ATT&CK technique T1059.001 for command and scripting interpreter and T1566 for credential harvesting through social engineering techniques that leverage the spoofing capabilities.
Organizations should implement comprehensive input validation and output encoding mechanisms to prevent this vulnerability, ensuring that all user-supplied data is properly sanitized before being rendered in web pages. Regular security updates from Microsoft, proper access controls, and network segmentation can help mitigate exploitation risks. Additionally, implementing content security policies and monitoring for suspicious script execution patterns provides defense-in-depth measures against potential exploitation of this XSS vulnerability in SharePoint environments.