Improper neutralization of input during web page generation in Microsoft SharePoint leads to a cross‑site scripting flaw that allows an authorized user to inject malicious content. The injected code is rendered as part of the SharePoint interface, enabling the attacker to make a malicious page appear authentic. This vulnerability can be used to spoof the SharePoint identity to end‑users, potentially facilitating phishing or other deceptive attacks. The weakness is identified as a classic cross‑site scripting vulnerability (CWE‑79).

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition are affected. No specific version numbers are listed in the CNA data, indicating that multiple releases within these product lines may be vulnerable. Administrators should review which installations are running these product lines and verify whether they have applied the available security update.

Based on the description, it is inferred that the attacker must already possess authorized access to the SharePoint environment to exploit the XSS flaw. The CVSS score of 4.6 classifies the severity as moderate, while the EPSS score of 7% indicates a moderate probability that this vulnerability will be actively exploited. It is not listed in the CISA KEV catalog. The primary threat vector is an insider or compromised account, and the risk increases where users are allowed to author or embed content in shared sites. Employing proper access control and content validation can reduce the likelihood of successful spoofing.