CVE-2026-64897

This vulnerability can be used to make SharePoint pages look like something legitimate, even though the content was tampered with. Think of it like someone putting up a convincing “welcome” sign inside your building that leads people to the wrong door. The danger is mainly for the other people in your organization who trust what they see on SharePoint.

This matters if you run Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition, especially where multiple users can create, edit, or publish SharePoint content. Because the attacker must already have valid credentials, it’s most risky in environments where internal accounts are plentiful or permissions are loosely managed. Also, it is not reachable in the default configuration, so the risk depends on whether an attacker can get to the parts of SharePoint needed to inject and get others to view the spoofed content.

This is RED because attackers are actively targeting SharePoint and this issue is tied to spoofed/misleading content that can trick real users who view the compromised pages. Even though it requires valid credentials and user interaction, patching is still critical because a single malicious or compromised account can cause harm to multiple users inside your organization.

1. Confirm exposure (what to check)
   • Identify your exact SharePoint product and build.
   • Compare your build to the fixed versions:
     • Enterprise Server 2016 fixed in 16.0.5565.1001
     • SharePoint Server 2019 fixed in 16.0.10417.20198
     • SharePoint Server Subscription Edition fixed in 16.0.19725.20522
2. Determine whether exploitation paths are realistically present
   • This flaw requires:
     • the attacker to have valid credentials
     • user interaction (another user visiting/viewing the compromised page)
     • and it is not reachable in default configuration (so confirm whether your configuration enables the relevant page/content generation paths).
   • Operationally, treat this as most urgent where more than a few people can create/edit SharePoint content or where accounts could realistically be compromised.
3. Patch/upgrade (target state)
   • Upgrade SharePoint to the fixed build for your branch (use the exact version listed above).
   • Plan for a maintenance window and follow Microsoft’s update guidance.
4. Post-patch verification
   • Re-check the SharePoint build/version to ensure it matches the fixed version.
   • Spot-check any recently edited/published pages for unexpected changes.
5. Temporary workaround if you cannot patch immediately
   • Reduce the number of users who can create/edit/publish content in SharePoint.
   • Remove or lock down any recently added pages that look suspicious, and limit what untrusted users can post.
   • Monitor for unusual content edits and publishing activity.

Note on KEV/CISA

• KEV is not listed for this CVE in the provided findings, and no public dated exploitation report was provided; however, the business risk remains high due to the credentialed spoofing nature and the threat-actor signal from PULSE.

CVE-2026-64897 is a spoofing vulnerability in Microsoft SharePoint Server where improper neutralization of input during web page generation can lead to a cross-site scripting style condition. In plain terms, an authenticated attacker can inject malicious or misleading content into SharePoint-generated pages so that other users who view those pages are deceived (spoofing). The findings indicate:

• Authentication required: yes (attacker must possess valid credentials)
• User interaction: required (other users must visit/view the affected pages)
• Reachable in default configuration: no
  No KEV listing was found, and there is no public exploit code on record in the provided findings. EPSS was reported as low and flat, but exploitation confirmation in KEV would override that; KEV was not listed here. Patch versions are available from Microsoft (see fix versions in this report), and PULSE indicates the issue is part of an active patch focus associated with Lazarus group activity.