The vulnerability arises from improper neutralization of input during web page generation, a form of cross‑site scripting (CWE‑79) and related to improper handling of input (CWE‑74). A privileged user can inject malicious scripts into pages that are then served to other network participants, enabling the attacker to spoof content and impersonate legitimate users. This can lead to phishing, credential theft, or other forms of social engineering when the spoofed pages are accessed by other users.

Affected systems include Microsoft SharePoint Server 2019 and Microsoft SharePoint Server Subscription Edition. No more granular version ranges are specified, so all deployments of these products are considered potentially vulnerable until a patch is applied.

The CVSS score of 7.3 indicates a high risk level, and the EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers require authorized access to the SharePoint environment, so the attack vector is likely a credential‑based web interaction. With a high CVSS score and a low EPSS score, administrators should monitor for updates and apply any available patches promptly.