{"id":"CVE-2026-109504","kind":"vulnerability","aliases":["CVE-2026-109504"],"related":[],"title":"Microsoft SharePoint: cross-site scripting lets an attacker spoof pages over network","description":"Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.","summary":"Microsoft Office SharePoint does not neutralize input when generating web pages, which is a cross-site scripting flaw. An authorized attacker can use it over the network to spoof content shown to other users.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Office SharePoint","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["microsoft-office","on-prem","sharepoint","vendor"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:20+00:00","first_seen_at":"2026-11-10T19:24:26+00:00","triaged_at":"2026-11-10T19:47:53+00:00","updated_at":"2026-11-10T19:47:53+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T19:47:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SharePoint: cross-site scripting lets an attacker spoof pages over network","impact":"medium","summary":"Microsoft Office SharePoint does not neutralize input when generating web pages, which is a cross-site scripting flaw. An authorized attacker can use it over the network to spoof content shown to other users.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sharepoint","microsoft-office","on-prem"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker spoofs page content seen by other SharePoint users","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-109504 for affected versions, fixed builds and whether SharePoint Online is affected.","how_to_check":"unknown","plain_action":"","product_name":"Microsoft Office SharePoint","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Microsoft SharePoint on premises or in a managed deployment where authenticated users can submit content that other users view. The sources do not name affected versions or configurations. Organizations using only SharePoint Online may be covered by the vendor's own changes; the sources do not say.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":4510,"output_tokens":502,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-109504 for affected versions, fixed builds and whether SharePoint Online is affected.","search":"'-109504':16A,19A '-2026':15A,18A 'allow':82C 'attack':9A,52B,85C 'author':51B,84C 'content':61B 'cross':4A,46B,75C 'cross-sit':3A,45B,74C 'cve':14A,17A 'flaw':49B 'generat':39B,73C 'improp':66C 'input':37B,69C 'let':7A 'microsoft':1A,20A,24B,31B,79C 'microsoft-offic':23B 'network':13A,58B,91C 'neutral':36B,67C 'offic':25B,32B,80C 'office':21A 'on-prem':26B 'page':11A,41B,72C 'perform':87C 'prem':28B 'script':6A,48B,77C 'sharepoint':2A,22A,29B,33B,81C 'shown':62B 'site':5A,47B,76C 'spoof':10A,60B,88C 'use':54B 'user':65B 'vendor':30B 'web':40B,71C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Microsoft SharePoint on premises or in a managed deployment where authenticated users can submit content that other users view. The sources do not name affected versions or configurations. Organizations using only SharePoint Online may be covered by the vendor's own changes; the sources do not say.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["microsoftofficesharepoint","officesharepoint"],"ptokens":["microsoft","office","sharepoint"],"labels":["high","microsoftoffice","onprem","sharepoint","vendor"],"campaign_type":null,"search_a":"'-109504':16A,19A '-2026':15A,18A 'attack':9A 'cross':4A 'cross-sit':3A 'cve':14A,17A 'let':7A 'microsoft':1A,20A 'network':13A 'office':21A 'page':11A 'script':6A 'sharepoint':2A,22A 'site':5A 'spoof':10A","search_b":"'attack':52B 'author':51B 'content':61B 'cross':46B 'cross-sit':45B 'flaw':49B 'generat':39B 'input':37B 'microsoft':24B,31B 'microsoft-offic':23B 'network':58B 'neutral':36B 'offic':25B,32B 'on-prem':26B 'page':41B 'prem':28B 'script':48B 'sharepoint':29B,33B 'shown':62B 'site':47B 'spoof':60B 'use':54B 'user':65B 'vendor':30B 'web':40B","search_c":"'allow':82C 'attack':85C 'author':84C 'cross':75C 'cross-sit':74C 'generat':73C 'improp':66C 'input':69C 'microsoft':79C 'network':91C 'neutral':67C 'offic':80C 'page':72C 'perform':87C 'script':77C 'sharepoint':81C 'site':76C 'spoof':88C 'web':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109504","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109504","severity":null,"published_at":"2026-11-10T19:18:20+00:00","modified_at":"2026-11-10T19:18:20+00:00","first_seen_at":"2026-11-10T19:24:26+00:00","fetched_at":"2026-11-10T19:24:26+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}