CVE-2026-64897

This vulnerability can be used to make SharePoint pages look like something legitimate, even though the content was tampered with. Think of it like someone putting up a convincing “welcome” sign inside your building that leads people to the wrong door. The danger is mainly for the other people in your organization who trust what they see on SharePoint.

This matters if you run Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition, especially where multiple users can create, edit, or publish SharePoint content. Because the attacker must already have valid credentials, it’s most risky in environments where internal accounts are plentiful or permissions are loosely managed. Also, it is not reachable in the default configuration, so the risk depends on whether an attacker can get to the parts of SharePoint needed to inject and get others to view the spoofed content.

This is RED because attackers are actively targeting SharePoint and this issue is tied to spoofed/misleading content that can trick real users who view the compromised pages. Even though it requires valid credentials and user interaction, patching is still critical because a single malicious or compromised account can cause harm to multiple users inside your organization.