CVE-2026-55126
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. The flaw is due to improper neutralization of input during web page generation.
Risk Assessment
An attacker can inject malicious scripts, leading to session theft, display of fraudulent content, or account takeover within the SharePoint environment.
Recommendation
Apply the security update provided by Microsoft for Microsoft Office SharePoint immediately. Additionally, implement input filtering and output encoding mechanisms in web applications.
Other vulnerabilities in Microsoft Office SharePoint
See all- CVE-2026-97783High
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-96044High
A vulnerability with no assigned CWE in Microsoft Office SharePoint allows an authenticated attacker to elevate privileges over a network. The flaw enables privilege escalation within the SharePoint environment.
- CVE-2026-88206High
Server-side request forgery (SSRF) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- CVE-2026-88204High
Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint due to improper input neutralization during web page generation. Allows an authorized attacker to perform spoofing over a network.
- CVE-2026-88200High
Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. The issue involves improper security context management.
- CVE-2026-88198High
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. The issue stems from improper access permission verification.
- CVE-2026-88166High
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-88163High
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-88155High
Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-85900High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS