CVE-2026-102864
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network
Published Oct 13, 2026 · updated Oct 14, 2026 · Microsoft Microsoft SharePoint Server Subscription Edition
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · NIST NVD
Detected
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Oct 14, 2026 · NIST NVD
Updated
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Affected
- cpe microsoft/sharepoint serverversion unspecified
- vendor Microsoft Microsoft SharePoint Server Subscription Editionversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-102864
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-102864
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-102864
30-day exploitation probability 0.4%
first.org - NCSC NetherlandsGovernment advisoryCVE-2026-102864
Microsoft heeft xxx kwetsbaarheden verholpen in diverse Office producten, zoals Word, Excel, Access, Outlook, Visio, Sharepoint en PowerPoint, maar ook subcomponenten als Shell, Azure Key Vault en Click-to-Run. Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-S
advisories.ncsc.nl - NIST NVDVulnerability recordCVE-2026-102864
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd.nist.gov