CVE-2026-45465

Microsoft SharePoint Server Spoofing Vulnerability

Published Jun 9, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Analysis

Technical impact

Microsoft SharePoint is vulnerable to a cross‑site scripting flaw caused by improper neutralization of input during web page generation, allowing an unauthorized attacker to perform spoofing over a network. An unauthorized attacker can embed malicious or forged content, leading to spoofed web pages being presented to users over the network. This vulnerability enables attackers to deceive users through phishing or social‑engineering attacks.

Affected Systems

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition are affected. All deployments of these releases contain the flaw unless a patch is applied.

Risk and Exploitability

The CVSS score of 5.4 indicates a moderate severity level. The EPSS score of less than 1 %, and the vulnerability is not listed in the CISA KEV catalog, implying no known active exploits. The likely attack vector is inferred to be the need for an attacker to supply content that is rendered in a SharePoint page—typically via the web interface or an administrative import—so the vulnerability requires some level of content creation or editing privilege to be exploited.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

Microsoft SharePoint Enterprise Server 2016

affected

Version	Status	Constraints
`16.0.0`	affected	< 16.0.5556.1005

Microsoft

Microsoft SharePoint Server 2019

affected

Version	Status	Constraints
`16.0.0`	affected	< 16.0.10417.20153

Microsoft

Microsoft SharePoint Server Subscription Edition

affected

Version	Status	Constraints
`16.0.0`	affected	< 16.0.19725.20384

Configuration 1 [-]

OR	cpe:2.3:a:microsoft:sharepoint_server:::::subscription:::*
	cpe:2.3:a:microsoft:sharepoint_server:2016::::enterprise:::
	cpe:2.3:a:microsoft:sharepoint_server:2019:::::::*

No data.

Vendor Product Versions

Microsoft

Sharepoint Server

Version	Status	Scheme	Platform
`[16.0.0,16.0.19725.20384)`	affected	generic	['x64-based_systems']

Microsoft

Sharepoint Server 2016

Version	Status	Scheme	Platform
`[16.0.0,16.0.5556.1005)`	affected	generic	['x64-based_systems']

Microsoft

Sharepoint Server 2019

Version	Status	Scheme	Platform
`[16.0.0,16.0.10417.20153)`	affected	generic	['x64-based_systems']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the official Microsoft security update for CVE‑2026‑45465 when it becomes available.
Restrict content creation and editing permissions to trusted users or groups to reduce opportunities for malicious input.
Implement strict output encoding for all data rendered in SharePoint pages, using Microsoft’s built‑in encoding functions to neutralize script tags.
Continuously monitor SharePoint logs for unexpected content injections or abnormal page rendering patterns that could indicate exploitation attempts.

Generated by OpenCVE AI on August 2, 2026 at 01:52 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.469% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45465

History

Jul 8, 2026 11:30 PM Description updated View changes

Type	Values Removed	Values Added
Description	Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.	Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Jun 10, 2026 8:30 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:microsoft:sharepoint_server:2016::::enterprise::: cpe:2.3:a:microsoft:sharepoint_server:2019:::::::*

Jun 10, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 9, 2026 5:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Title		Microsoft SharePoint Server Spoofing Vulnerability
First Time appeared		Microsoft Microsoft sharepoint Server Microsoft sharepoint Server 2016 Microsoft sharepoint Server 2019
Weaknesses		CWE-79
CPEs		cpe:2.3:a:microsoft:sharepoint_server:::::subscription:::* cpe:2.3:a:microsoft:sharepoint_server_2016:::::enterprise:::* cpe:2.3:a:microsoft:sharepoint_server_2019::::::::
Vendors & Products		Microsoft Microsoft sharepoint Server Microsoft sharepoint Server 2016 Microsoft sharepoint Server 2019
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45465
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C'}`