Medium 4.6

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft...

CVE-2026-109456 First seen on SecPulse 03:20

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
Microsoft	MicrosoftMicrosoft SharePoint Server Subscription Edition	≥ 16.0.0, < 16.0.20326.20278→ 16.0.20326.20278	16.0.20326.20278

Original description The description as published by the source.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Source: Microsoft Security Response Center Blog NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 4.6; CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Published: Nov 11, 2026
First seen on SecPulse: 03:20
GHSA: GHSA-8vmp-c4f6-rxrm
CWE: CWE-79

NVD GitHub Advisory

Tags(click for explanation)

Vendors

Microsoft

All

Msrc Microsoft Sharepoint Server Subscription Edition

Attack Types

Cross-Site Scripting

CWE

CWE-79

Detection sources

NIST National Vulnerability Database06:18
GitHub Security Advisories (Global)06:32
Microsoft Security Response Center Blog03:20
CVE.org (CVE Program・cvelistV5)08:46