MSRC-CVE-2026-97783 — Microsoft Office SharePoint Spoofing Vulnerability

Summary

Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How could an attacker exploit the vulnerability?
An attacker who successfully exploited this vulnerability might be able to run their scripts in the security context of the current user by enticing the user to click on a link resulting in a cross-site scripting attack on the SharePoint Server.

Security updates
16.0.10417.20175 — https://support.microsoft.com/help/5002883
16.0.5561.1001 — https://support.microsoft.com/help/5002891
16.0.19725.20434 — https://support.microsoft.com/help/5002882

Vulnerabilities 1

High 8.1

CVE-2026-97783

Microsoft Office SharePoint Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Microsoft Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Server Subscription Edition

Oct 13, 2026

Revision history

2026-10-21 #2
The vulnerability associated with this CVE was fixed in July, however was inadvertently not included with that release. Microsoft recommends updating to the most current release of the SharePoint server.
2026-10-13 #1
Information published.

References

CVE-2026-97783 Microsoft Office SharePoint Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97783
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss