CVE-2026-45481: Microsoft SharePoint Server Spoofing Vulnerability

Synopsis

A cross-site scripting (XSS) vulnerability exists in Microsoft SharePoint Server that allows an authenticated attacker to inject malicious scripts into web pages served to other users, a technique known as spoofing. The vulnerability is reachable over the network, requires a low-privilege account, and also requires a victim to interact with attacker-controlled content. Successful exploitation gives the attacker read access to sensitive data and the ability to modify content within the victim's browser session. Patched-image rebuilds at versions 16.0.5556.1005, 16.0.10417.20153, and 16.0.19725.20384 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SharePoint service over the network to deliver the malicious payload.

• AuthenticationRequired

  A low-privilege SharePoint account is sufficient; no admin rights are needed, but unauthenticated access alone is not enough.

• Victim interactionRequired

  A victim must interact with attacker-controlled content, such as opening a crafted SharePoint page or link, for the injected script to execute.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific environmental configurations.

Blast Radius

• Reads session tokens, cookies, and page content within the victim's authenticated SharePoint context.
• Modifies or injects visible page content in the victim's browser, enabling credential-harvesting or phishing within the trusted SharePoint origin.
• Does not directly crash or degrade the SharePoint service; availability is unaffected by this exploit path.