The vendor has published a fix. Version details are below where the sources state them.
Steps
Written by AI from the record
Check your Microsoft SharePoint Server version for whether it is older than the fixed releases for your edition (SharePoint Server 2019 vs Subscription Edition).
If you are on an affected version, plan and schedule an upgrade to the fixed version: SharePoint Server 2019 → 16.0.10417.20198, or Subscription Edition/sharepoint server → 16.0.19725.20522.
After updating, verify SharePoint is serving the updated build and that web-facing pages reject/neutralize malicious input attempts (as validated by your security or QA process).
If you cannot patch immediately, restrict who can access SharePoint accounts with the least privilege needed and reduce exposure of the SharePoint site to untrusted users while you prepare the upgrade.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
In plain language
Written by AI from the record
This is a SharePoint security flaw where a logged-in attacker can trick other users’ browsers into running malicious code and impersonating trusted SharePoint content; if you allow user accounts and don’t keep SharePoint fully updated, it’s something you should act on now.
CVE-2026-57105 is a CWE-79 script injection (cross-site scripting) flaw in Microsoft SharePoint Server where an authenticated attacker can send a malicious payload over the network that gets executed in victims’ browsers, enabling spoofing of trusted content and potentially arbitrary actions within the browser/session.
If you're affected
Account/session impersonation in browsers
Sensitive SharePoint data exposure
Malicious actions under trusted UI
Operational disruption from compromise
What is it
Think of SharePoint as a company notice board and log-in area. This flaw lets a person who already has a SharePoint account send a crafted message that can make other users’ browsers display fake “trusted” content and run malicious code. If that happens, attackers can potentially hijack a user’s session (acting as them) and reach information or actions they shouldn’t.
Who is affected
This matters if your business runs Microsoft SharePoint Server 2019 or Microsoft SharePoint Server Subscription Edition (sharepoint server) and your SharePoint is reachable by users who can log in. The key requirement is that an attacker must already have authorized access (a valid account) to the vulnerable SharePoint instance. Exposure is primarily a risk when an attacker can log into your SharePoint (for example, via stolen/compromised credentials or an overly broad set of user access).
How urgent is it
This is RED because attackers with valid SharePoint access can use this flaw to inject malicious scripts into other users’ browsers and impersonate trusted content, which can lead to session hijacking or data access. While there is no CISA KEV listing and no public exploit code reported in the findings, it is new attention driven by a patch, and the actor noted in reporting (Lazarus group) is a strong signal to treat this as active risk in the real world.
What to do — in detail
Confirm exposure
Determine which product/edition you run:
Microsoft SharePoint Server 2019
Microsoft SharePoint Server Subscription Edition (sharepoint server)
Check your current installed build/version of SharePoint.
Compare against the fixed releases:
SharePoint Server 2019: fixed in 16.0.10417.20198
Subscription Edition / sharepoint server: fixed in 16.0.19725.20522
Patch/upgrade (primary remediation)
Upgrade to the fixed build for your edition.
Schedule downtime as required by your SharePoint operations plan.
After the upgrade, confirm:
The SharePoint farm is now on the fixed version.
The updated site is functioning normally for your typical user workflows.
Temporary containment if patching is delayed
Reduce the chance that a malicious “authorized” account exists:
Enforce least privilege for SharePoint users and limit broad write/admin access.
Review recent account changes and disable unused accounts.
Strengthen password/account protection for SharePoint logins (especially if you have shared or weak credentials).
Limit who can reach the site from outside your trusted user base until patching is complete.
What to monitor
Look for signs of account abuse and session anomalies in SharePoint/audit logs (especially unusual actions performed by accounts that should not normally do them).
Watch for suspicious browser-side behavior reports from users (for example, users seeing unexpected prompts, unexpected “trusted” content, or pages that look like SharePoint but behave oddly).
KEV/CISA timing
KEV is not listed for this CVE in the findings provided, so there is no CISA due date to follow.
Technical context
Severity and weakness
Weakness class: CWE-79 (Cross-site scripting).
Impact mechanism (from findings): an authenticated attacker can exploit a script injection flaw to impersonate trusted content and execute malicious code in victims’ browsers, potentially enabling takeover of the victim’s session or access to data.
Attack vector and requirements
Network-based attack vector.
Authentication requirement: the attacker needs authorized access to the vulnerable SharePoint instance.
User interaction: required (victims must load affected content in their browsers).
Exploitation status
KEV: not listed in CISA KEV.
Exploit code: no public exploit code on record in the findings.
News/incidents: no clear dated claim of exploitation and no incidents reported in the findings.
Practical risk posture: reporting notes new attention tied to the patch, and an actor associated with recent reporting (Lazarus group) is mentioned, so treat this as an immediate patch priority for environments where a malicious or compromised account could exist.
EPSS
EPSS is provided as a prediction in the findings, but public blocks should not rely on it given the RED verdict and the importance of authenticated attack prerequisites.
Fixed versions (for verification)
Microsoft SharePoint Server 2019: fixed in 16.0.10417.20198.
Microsoft SharePoint Server Subscription Edition / sharepoint server: fixed in 16.0.19725.20522.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
