CVE-2026-55019
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. The issue stems from improper neutralization of input during web page generation.
Risk Assessment
An attacker can inject malicious script that executes in other users' browsers, potentially leading to session hijacking, data leakage, or display of fraudulent content.
Recommendation
Apply the security update provided by Microsoft for Microsoft Office SharePoint immediately. Additionally, consider implementing Content Security Policy (CSP) and input filtering.
Other vulnerabilities in Microsoft Office SharePoint
See all- CVE-2026-40368High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-40357High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-35439High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-33112High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-33110High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-20951High
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
- CVE-2026-20947High
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-70306Critical
A cross-site scripting vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-70332Critical
Improper input neutralization during web page generation (cross-site scripting) in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-55040CriticalActively exploited
A vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over the network due to weak authentication.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.