CVE-2026-64916

Think of SharePoint like a company bulletin board with pages that employees visit. This flaw lets an attacker who already has a SharePoint account sneak in “fake content” scripts so that the page can look like something trustworthy while it’s actually misleading users. That can lead to internal phishing, where employees are tricked into actions like entering passwords or approving requests.

This matters if you run Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition, because the attacker must already have valid (lower-privilege) credentials to exploit it. The attack happens over the network and requires that users interact with the affected page (so it’s about tricking someone who visits the page), rather than a purely background takeover. Treat it as a risk when a malicious or untrusted user account can reach SharePoint (for example, an account that shouldn’t have access, is shared, or was recently compromised).

This is RED because it’s a spoofing-style web attack that can be used by an attacker who already has SharePoint credentials to mislead other users. Even though there’s no confirmed dated report of incidents in the provided material, a new patch is available and the patching work should be prioritized promptly to reduce exposure from internal or compromised accounts.