🟠 High | Source: Microsoft Security Response Center
A cross-site scripting (XSS) vulnerability in Microsoft SharePoint allows an unauthenticated attacker to perform spoofing attacks over a network by injecting malicious content into web pages served by SharePoint. This type of flaw can be exploited to steal session tokens, redirect users to malicious sites, or perform actions on behalf of legitimate users. As SharePoint is widely used for collaboration and document management across enterprises, the potential for data exposure and account compromise is significant.
Security Architect’s Take: Prioritise applying the relevant Microsoft security patch to all SharePoint deployments immediately, and in the interim review WAF rules to detect and block XSS payloads targeting SharePoint endpoints. Audit SharePoint external sharing settings to reduce the attack surface for unauthenticated network-based exploitation.
Original advisory: CVE-2026-70332 Microsoft Office SharePoint Spoofing Vulnerability