CVE‑2026‑97783: SharePoint Server Spoofing Vulnerability – Immediate Update Required

What happened

In July, Microsoft released a cumulative security update that was intended to address a spoofing flaw in SharePoint Server. However, the fix for CVE‑2026‑97783 was inadvertently omitted from that release. The vulnerability allows an attacker to craft a malicious SharePoint URL that appears to originate from a legitimate site, potentially tricking users into divulging credentials or executing malicious content.

The flaw resides in the way SharePoint validates the host header and the referrer information when rendering page links. An attacker who can influence the host header can cause SharePoint to generate links that point to arbitrary domains, thereby enabling phishing or credential harvesting attacks.

Who is affected

All organizations running Microsoft SharePoint Server 2016, 2019, or 2022 are potentially vulnerable if they have not applied the latest cumulative update that includes the missing patch. This includes on‑premises deployments as well as SharePoint Online customers who rely on the same underlying code base for certain features.

Administrators who have applied the July update but have not verified that the CVE‑2026‑97783 fix is present remain exposed. The vulnerability is not limited to a specific configuration; any SharePoint site that accepts external URLs can be abused.

Impact

Successful exploitation can lead to social‑engineering attacks where users are redirected to a spoofed site that mimics the corporate SharePoint portal. Attackers can then capture login credentials, inject malicious scripts, or perform credential stuffing against downstream services.

Because the flaw does not require authentication, it can be triggered by an unauthenticated user who visits a crafted link. This increases the attack surface and makes the vulnerability particularly dangerous for publicly exposed SharePoint sites.

Exposure

Attackers can discover vulnerable sites by scanning for SharePoint Server installations that have not been patched to the latest cumulative update. Once identified, they can craft a URL that includes a forged host header to generate malicious links within the SharePoint interface.

Exploitation is straightforward: a malicious link is embedded in an email or a compromised website, and when a user clicks it, SharePoint renders the link pointing to the attacker’s domain. The user is then prompted to log in, and the credentials are captured.

What to do

• Verify that the latest cumulative update for SharePoint Server is installed on all on‑premises servers. The update should include the patch for CVE‑2026‑97783; check the Microsoft Security Update Guide for the specific KB number.
• For SharePoint Online, ensure that the tenant is receiving the latest security updates. Microsoft automatically rolls out patches, but confirm that no custom configurations are blocking the update.
• Implement host header validation by restricting allowed host headers in the SharePoint web application settings. This limits the ability of an attacker to forge host headers.
• Deploy web application firewall rules that block requests containing suspicious host headers or referrer values that do not match the corporate domain.
• Enable multi‑factor authentication for all SharePoint users to mitigate credential theft if a phishing link is clicked.
• Review audit logs for anomalous authentication attempts or repeated failed logins that may indicate credential harvesting.

What to watch

• New phishing campaigns that target SharePoint users with URLs mimicking the corporate portal.
• Reports of unusual outbound traffic from SharePoint servers to external domains that could indicate malicious link generation.
• Indicators of compromise such as the presence of the CVE‑2026‑97783 exploit code in malware samples or threat‑intel feeds.