CVE-2026-57105

Think of SharePoint as a company notice board and log-in area. This flaw lets a person who already has a SharePoint account send a crafted message that can make other users’ browsers display fake “trusted” content and run malicious code. If that happens, attackers can potentially hijack a user’s session (acting as them) and reach information or actions they shouldn’t.

This matters if your business runs Microsoft SharePoint Server 2019 or Microsoft SharePoint Server Subscription Edition (sharepoint server) and your SharePoint is reachable by users who can log in. The key requirement is that an attacker must already have authorized access (a valid account) to the vulnerable SharePoint instance. Exposure is primarily a risk when an attacker can log into your SharePoint (for example, via stolen/compromised credentials or an overly broad set of user access).

This is RED because attackers with valid SharePoint access can use this flaw to inject malicious scripts into other users’ browsers and impersonate trusted content, which can lead to session hijacking or data access. While there is no CISA KEV listing and no public exploit code reported in the findings, it is new attention driven by a patch, and the actor noted in reporting (Lazarus group) is a strong signal to treat this as active risk in the real world.