The vulnerability arises from improper neutralization of input during web page generation, a form of cross‑site scripting (CWE‑74). A privileged user can inject malicious scripts into pages that are then served to other network participants, enabling the attacker to spoof content and impersonate legitimate users. This can lead to phishing, credential theft, or other forms of social engineering when the spoofed pages are accessed by other users.

Affected systems include Microsoft SharePoint Server 2019 and Microsoft SharePoint Server Subscription Edition. The CVE description does not specify more granular version ranges, so all deployments of these products are considered potentially vulnerable until a patch is applied.

The CVSS score of 7.3 indicates a high risk level, and the exploitability metric is not publicly available, meaning it is unclear how likely an attacker can exploit this remotely. The vulnerability is not listed in the CISA KEV catalog. Attackers require authorized access to the SharePoint environment, so the attack vector is likely a credential‑based web interaction. With medium to high risk and the need for privileged credentials, administrators should prioritize patching.