CVE-2026-64900

Think of SharePoint as a company bulletin board. This bug lets a logged-in user write “trick” content into a SharePoint page that can run in someone else’s browser when they view it—like putting a fake login prompt or hidden script on the page. That can allow the attacker to impersonate the app in the victim’s browser session or steal sensitive information.

This matters if you run Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition, or sharepoint server and have users with low privileges who can create or edit content that appears on web pages. The attack requires an authenticated account on the SharePoint server, and it only becomes a risk when a victim visits the attacker-crafted page.

Treat this as urgent because a real attacker with a valid SharePoint account can plant malicious content that executes when other users view the page. Even without a public exploit on record, this kind of page-based browser impact is exactly the sort of issue attackers look for once they gain access to an account with basic rights.

Confirm exposure

• Identify your installed SharePoint product and current build.
• Determine whether your build is older than the fixed versions Microsoft listed for CVE-2026-64900:
  • Microsoft SharePoint Enterprise Server 2016: fixed in 16.0.5565.1001
  • Microsoft SharePoint Server 2019: fixed in 16.0.10417.20198
  • Microsoft SharePoint Server Subscription Edition: fixed in 16.0.19725.20522 (also listed for “sharepoint server”)

Patch / upgrade

• Apply the Microsoft update for CVE-2026-64900 using the Microsoft Update Guide entry for the vulnerability.
• Plan for downtime/maintenance windows as required by your standard SharePoint patching process (follow your organization’s operational procedures).

Temporary workaround (if patching is delayed)

• Reduce who can create or edit content that becomes part of SharePoint-generated web pages.
• Tighten permissions so low-privilege users cannot publish or modify pages viewed by a broad audience.
• Watch for unusual page edits by non-administrators and limit exposure of publicly accessible/shared pages.

Monitor after changes

• Review SharePoint audit logs (or equivalent monitoring) for:
  • unexpected page edits/insertions
  • spikes in suspicious content changes around the patch window
  • signs that users experienced unexpected prompts or session changes after visiting SharePoint pages

Due date

• KEV listing: not listed in CISA KEV based on provided findings, so no KEV-specific CISA deadline was provided here.

CVE-2026-64900 is a Microsoft SharePoint Server spoofing vulnerability described as improper neutralization of input during web page generation (Cross-Site Scripting–style behavior, aligned to CWE-79). Mechanism from findings: an authenticated attacker with low privileges can inject malicious code into SharePoint-generated pages; when another user visits the crafted page, the code executes in the victim’s browser session, enabling impersonation of the application and potential sensitive data theft.

Exploitability signals from provided findings: no public exploit code on record and no clear dated press claim of exploitation; however, patch-related press attention and an actor attribution signal (“Lazarus group”) were reported in the provided PULSE findings. No KEV entry was provided for this CVE. EPSS is given as a prediction (flat trend), but it is not treated as evidence of real-world exploitation in this summary.