CVE-2026-64900

Think of SharePoint as a company bulletin board. This bug lets a logged-in user write “trick” content into a SharePoint page that can run in someone else’s browser when they view it—like putting a fake login prompt or hidden script on the page. That can allow the attacker to impersonate the app in the victim’s browser session or steal sensitive information.

This matters if you run Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition, or sharepoint server and have users with low privileges who can create or edit content that appears on web pages. The attack requires an authenticated account on the SharePoint server, and it only becomes a risk when a victim visits the attacker-crafted page.

Treat this as urgent because a real attacker with a valid SharePoint account can plant malicious content that executes when other users view the page. Even without a public exploit on record, this kind of page-based browser impact is exactly the sort of issue attackers look for once they gain access to an account with basic rights.