CVE-2026-64922

This flaw lets a user who can already log into SharePoint change what other people see—like swapping a trusted page for something that looks normal but causes users to click or load harmful content. Think of it like a business bulletin board where someone with basic access can put up a fake notice that tricks coworkers. In this case, the likely outcomes are limited data exposure and small changes to records, not total takeover.

This matters if you run Microsoft SharePoint Server (SharePoint Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition) and your SharePoint is reachable and used by multiple people. Because the attacker needs to be authenticated at a low level, the risk is highest if an attacker could log in as a user who can influence page content. The vulnerability is a risk in default configurations because it’s reachable, but the main gate is that the attacker must already have authenticated access and then trick other users into interacting with the changed content.

This is RED because the weakness is reachable in default configurations and can be triggered by an authenticated (low-level) user to trick other users. While there’s no clear, dated public exploitation report tying to CVE-2026-64922 in the provided news, Microsoft has released fixed versions and this is being tracked with active patch-driven attention. Treat it as urgent to close the gap, especially if you have users or accounts that could be abused.