MSRC-CVE-2026-55034 — Microsoft SharePoint Server Spoofing Vulnerability

Summary

Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, user interaction is required (UI:R) and privileges required is low (PR:L). What does that mean for this vulnerability?
An authorized attacker must send the user a malicious link and convince the user to open it.

Security updates
16.0.5561.1001 — https://support.microsoft.com/help/5002891
16.0.10417.20175 — https://support.microsoft.com/help/5002883
16.0.19725.20434 — https://support.microsoft.com/help/5002882

Vulnerabilities 1

High 7.3

CVE-2026-55034

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Microsoft Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Server Subscription Edition

Jul 14, 2026

Revision history

2026-07-14 #1
Information published.

References

CVE-2026-55034 Microsoft SharePoint Server Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55034
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss