The vulnerability is improper neutralization of user‑supplied input during web page generation, a form of cross‑site scripting, in Microsoft Office SharePoint. An attacker can submit malicious content that is then rendered in clients' browsers as if it came from the legitimate SharePoint site, enabling spoofed content or deceptive actions. The flaw does not grant direct server control or elevated privileges, but the injected script may trick users into interacting with malicious content, harvesting credentials, or altering submitted data. Based on the description, it is inferred that the attacker injects harmful code into SharePoint pages or content that is delivered to browsers over the network.

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition are affected. The advisory does not specify affected or fixed version ranges, so any installation that has not applied the CVE‑2026‑45464 update remains at risk.

The CVSS score of 5.4 labels the issue as moderately severe, while the EPSS score of <1 % indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by submitting malicious input through standard SharePoint interactions, such as editing pages or adding content, without needing elevated privileges, which may result in spoofing of content is client‑side via browser rendering.