CVE-2026-70332

This flaw is like an email “look-alike” that can appear to be from SharePoint, but with malicious content inserted into the page. If an attacker gets a victim to view the crafted page, they may be able to trick the victim, steal session/account information, or disrupt business use of SharePoint.

This matters if your company uses Microsoft SharePoint Online for documents, collaboration, or employee workflows. Because the issue involves spoofing through web content, it’s most relevant to users who might click links to SharePoint pages received over email, chat, or the web. The risk is specifically tied to whether an attacker can reach a crafted SharePoint page and get a user to view/interact with it (user interaction is required).

Treat this as urgent (RED) because the vulnerability is rated critical and can be used to spoof users, which is a direct path to account and workflow compromise. Press attention is sustained, and a major threat actor is referenced in the coverage, so waiting increases the chance your users are exposed to real-world attempts.

1. Identify exposure scope (do this first)

• Confirm you are running Microsoft SharePoint Online (Microsoft’s cloud service). If you only use something else (like on-prem SharePoint), the applicability may differ.
• Inventory who has access and who can receive or click external links (email, chat, web portals).

2. Check for the fix on Microsoft’s side (SharePoint Online)

• Go to Microsoft’s update guidance page for CVE-2026-70332 on MSRC.
• Follow Microsoft’s instructions to determine whether the fix is already in effect for your tenant, and whether any tenant-side actions are required.

3. Tenant-side risk reduction while waiting for confirmation (action now)

• Review external sharing controls in SharePoint/Office 365 admin settings: limit who can share externally and how links are generated.
• Tighten link sharing: require sign-in where possible and remove broad/public link options.
• Review and restrict add-ins and custom content that could increase the chance of user-facing spoofing.
• Ensure your security team (or IT admin) can rapidly revoke access or disable risky sharing if suspicious activity is detected.

4. Confirm safety through monitoring

• Watch for unusual sign-in behavior around the time users access links or report suspicious SharePoint pages.
• Monitor for abnormal SharePoint actions (unexpected file access, changes, or access from new locations/devices).

5. User response playbook

• Update your internal guidance: users should report any unexpected SharePoint-looking prompts immediately and not provide credentials or approve actions from suspicious pages.

6. Escalate if needed

• If Microsoft guidance indicates additional tenant actions, prioritize them.
• If you cannot confirm the fix timing from Microsoft’s guidance, open a support request referencing CVE-2026-70332 and ask for tenant applicability/rollout status.

CISA KEV note

• This CVE is not listed in CISA KEV based on the provided findings.

CVE-2026-70332 is a Microsoft Office SharePoint (SharePoint Online) vulnerability mapped to CWE-79 (cross-site scripting). The mechanism is improper neutralization of input during web page generation, which can allow attacker-controlled content to be rendered in a way that supports spoofing. The provided findings do not list this issue in CISA KEV, and there is no public exploit code on record; however, the traffic-light verdict is RED due to the critical severity and sustained attention. PULSE coverage references actor Lazarus group and indicates patch-related attention. Attackers would aim to deliver a crafted page/content that relies on user interaction (victim viewing/engaging the spoofed content), consistent with a high likelihood of harm when users are tricked. KEV was not confirmed for this CVE in the provided materials, so exploitation status is not confirmed via KEV.