Vulnerabilities
Microsoft Office SharePoint Spoofing Vulnerability (CVE-2026-102864)
A cross‑site scripting flaw in SharePoint’s page generation lets authenticated attackers inject spoofed content, enabling social‑engineering attacks. Patching and tightening permissions are critical.
What happened
A cross‑site scripting flaw in Microsoft Office SharePoint’s web page generation can be abused by an authenticated user to inject malicious content that appears as legitimate SharePoint pages, effectively spoofing the site over the network.
Impact
Authenticated attackers can create or modify SharePoint pages to display forged content, potentially tricking users into providing credentials or downloading malware. The flaw does not allow remote code execution but can be used for social‑engineering attacks.
Who is affected
All deployments of Microsoft Office SharePoint that have not applied the latest security updates. The issue is present in the SharePoint web application component, regardless of the underlying Windows Server version.
Mitigation
- Apply the latest Microsoft security update for SharePoint (KB… or the update released on 2026‑??).
- Restrict the ability to edit or create pages to trusted users only.
- Enable a Content Security Policy that blocks inline scripts and disallows external script sources.
- Monitor SharePoint logs for unexpected page creation or modification events.
- Consider deploying a web‑application firewall that blocks XSS payloads.
What to do now
Immediately verify whether your SharePoint environment has the recent patch applied. If not, schedule an update and review user permissions. Keep an eye on anomalous page changes and educate users about spoofing risks.
Related vulnerabilities
Microsoft Office SharePoint SSRF Spoofing Vulnerability (CVE-2026-105713)
A server‑side request forgery flaw in Microsoft Office SharePoint can let an authenticated user spoof requests to adjacent networks. The issue is rated critical and affects all SharePoint deployments. Apply the latest patch and tighten network controls immediately.
Read briefing
Microsoft SharePoint Server Spoofing Vulnerability (CVE-2026-63516) Acknowledged
Microsoft has acknowledged a spoofing vulnerability in SharePoint Server (CVE-2026-63516). The issue could allow attackers to impersonate legitimate users or services. Defenders should verify if their SharePoint deployments are affected and apply any forthcoming patches or mitigations.
Read briefing
CVE-2026-102862: SharePoint Elevation of Privilege Vulnerability
Microsoft Office SharePoint is vulnerable to an elevation of privilege flaw (CVE‑2026‑102862) that allows an authenticated attacker to gain higher permissions on a network. The flaw affects SharePoint Server 2013/2016/2019 and SharePoint Online. Defenders should apply the latest cumulative update, audit permissions, and monitor for unauthorized privilege changes.
Read briefing
CVE-2026-105720: SharePoint Elevation of Privilege Vulnerability
A flaw in Microsoft Office SharePoint’s authorization logic lets an authenticated user gain higher privileges on the network. The issue affects all SharePoint deployments that have not applied the latest security update. Apply the patch immediately and audit user permissions.
Read briefing