{"id":"CVE-2026-109454","kind":"vulnerability","aliases":["CVE-2026-109454"],"related":[],"title":"Microsoft SharePoint: cross-site scripting lets an authorized user spoof pages","description":"Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.","summary":"Microsoft Office SharePoint fails to neutralize input when generating web pages, a cross-site scripting flaw. An attacker with a valid account can perform spoofing over the network.","severity":"critical","cvss":9.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Office SharePoint","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Microsoft SharePoint Server Subscription Edition","fixed":["16.0.20326.20278"],"affected":">= 16.0.0, < 16.0.20326.20278","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["microsoft","microsoft-office","self-hosted","sharepoint","spoofing","vendor","xss"],"not_affected_if":["managed-hosting"],"how_to_check":"In SharePoint Central Administration > Upgrade and Migration > Check product and patch installation status, or run (Get-SPFarm).BuildVersion in the SharePoint Management Shell; builds below 16.0.20326.20278 are affected.","fix":"Update SharePoint Server Subscription Edition to build 16.0.20326.20278 or later (per Microsoft CNA data in NVD; confirm on the MSRC page).","status":"open","published_at":"2026-11-10T19:18:14+00:00","first_seen_at":"2026-11-10T19:24:23+00:00","triaged_at":"2026-11-10T19:25:51+00:00","updated_at":"2026-11-10T19:37:26+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T19:25:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SharePoint: cross-site scripting lets an authorized user spoof pages","impact":"medium","summary":"Microsoft Office SharePoint fails to neutralize input when generating web pages, a cross-site scripting flaw. An attacker with a valid account can perform spoofing over the network.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sharepoint","microsoft-office"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker spoofs pages and injects script into SharePoint sessions","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-109454 for affected builds, fixed versions and whether user interaction is required.","how_to_check":"unknown","plain_action":"","product_name":"Microsoft Office SharePoint","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000652,"input_tokens":4511,"output_tokens":401,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-109454 for affected builds, fixed versions and whether user interaction is required.","search":"'-109454':15A,18A '-2026':14A,17A 'account':60B 'allow':83C 'attack':56B,86C 'author':9A,85C 'cross':4A,51B,76C 'cross-sit':3A,50B,75C 'cve':13A,16A 'edition':26A 'fail':41B 'flaw':54B 'generat':46B,74C 'host':33B 'improp':67C 'input':44B,70C 'let':7A 'microsoft':1A,19A,22A,27B,29B,38B,80C 'microsoft-offic':28B 'network':66B,92C 'neutral':43B,68C 'offic':30B,39B,81C 'office':20A 'page':12A,48B,73C 'perform':62B,88C 'script':6A,53B,78C 'self':32B 'self-host':31B 'server':24A 'sharepoint':2A,21A,23A,34B,40B,82C 'site':5A,52B,77C 'spoof':11A,35B,63B,89C 'subscription':25A 'user':10A 'valid':59B 'vendor':36B 'web':47B,72C 'xss':37B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted SharePoint Server Subscription Edition farms running a build below 16.0.20326.20278. The attacker needs a valid account and a user must interact (e.g. open a crafted page), so it matters most where many people can author content. SharePoint Online is not listed in the source; teams without an on-premises SharePoint farm can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["microsoftofficesharepoint","microsoftsharepointserversubscriptionedition","officesharepoint","sharepointserversubscriptionedition"],"ptokens":["edition","microsoft","office","server","sharepoint","subscription"],"labels":["critical","microsoft","microsoftoffice","selfhosted","sharepoint","spoofing","vendor","xss"],"campaign_type":null,"search_a":"'-109454':15A,18A '-2026':14A,17A 'author':9A 'cross':4A 'cross-sit':3A 'cve':13A,16A 'edition':26A 'let':7A 'microsoft':1A,19A,22A 'office':20A 'page':12A 'script':6A 'server':24A 'sharepoint':2A,21A,23A 'site':5A 'spoof':11A 'subscription':25A 'user':10A","search_b":"'account':60B 'attack':56B 'cross':51B 'cross-sit':50B 'fail':41B 'flaw':54B 'generat':46B 'host':33B 'input':44B 'microsoft':27B,29B,38B 'microsoft-offic':28B 'network':66B 'neutral':43B 'offic':30B,39B 'page':48B 'perform':62B 'script':53B 'self':32B 'self-host':31B 'sharepoint':34B,40B 'site':52B 'spoof':35B,63B 'valid':59B 'vendor':36B 'web':47B 'xss':37B","search_c":"'allow':83C 'attack':86C 'author':85C 'cross':76C 'cross-sit':75C 'generat':74C 'improp':67C 'input':70C 'microsoft':80C 'network':92C 'neutral':68C 'offic':81C 'page':73C 'perform':88C 'script':78C 'sharepoint':82C 'site':77C 'spoof':89C 'web':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109454","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109454","severity":null,"published_at":"2026-11-10T19:18:14+00:00","modified_at":"2026-11-10T19:18:14+00:00","first_seen_at":"2026-11-10T19:24:23+00:00","fetched_at":"2026-11-10T19:24:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109454:2530","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109454","severity":null,"published_at":"2026-11-10T19:37:26+00:00","modified_at":"2026-11-10T19:37:26+00:00","first_seen_at":"2026-11-10T19:37:26+00:00","fetched_at":"2026-11-10T19:37:26+00:00","note":"MSRC page is JS-only and did not render; used NVD record carrying Microsoft CNA data (SharePoint Server Subscription Edition 16.0.0 < 16.0.20326.20278, CVSS 9.0 PR:L UI:R S:C). Nothing marked verified. No exploitation/PoC seen; social search skipped.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-109454"]}],"documents":[{"id":117595,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109454","title":"NVD: CVE-2026-109454 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}