CVE-2026-64902

This vulnerability lets a user who already has a SharePoint account put “bad scripts” into content so that other visitors to SharePoint can be tricked in their browser. Think of it like a trusted company notice that looks normal, but silently alters what the reader sees or how their browser behaves.

This matters if you run Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition, and you have users who can publish or edit content that others view.

The key risk gate is that an attacker must already be authenticated with valid credentials (low privileges) and then get their injected content viewed by someone else (user interaction).

This is a RED issue because it allows an authenticated user to inject malicious script that can run in other users’ browsers, which is a common path to account and session compromise. Even though no specific public exploitation report for this exact CVE was provided, the impact pattern is serious and Microsoft has released fixes for all supported branches.

1. Identify exposure

• Log into your SharePoint environment and identify the exact SharePoint version build.
• Compare it to the fixed versions Microsoft lists for this CVE.

2. Determine whether you have the “reachability” conditions

• CVE-2026-64902 requires an authenticated user (low privileges) to inject malicious script, and another user must view/interact with the affected content.
• Practical check: list who can create/edit/publish content (and any accounts that are less trusted, such as contractors or loosely controlled external collaborators).

3. Apply the patch (target fixed builds)

• Microsoft SharePoint Enterprise Server 2016: upgrade to 16.0.5565.1001.
• Microsoft SharePoint Server 2019: upgrade to 16.0.10417.20198.
• Microsoft SharePoint Server Subscription Edition (and “sharepoint server” fixed baseline): upgrade to 16.0.19725.20522.

4. If patching is delayed (temporary risk reduction)

• Reduce who can publish or edit web-rendered content: temporarily tighten permissions for content creation/publishing to only essential, trusted accounts.
• Review account access: remove/disable unused accounts and scrutinize recently added users with content editing rights.
• If you suspect a compromised account, treat it as an incident: revoke affected credentials and rotate passwords for users who may have accessed SharePoint.

5. Monitor for signs of tampering

• Look for unusual or recently added SharePoint content (pages, posts, web parts) that contain unexpected HTML/script-like content.
• Review SharePoint/web logs around content publishing actions by accounts with content-edit permissions.

6. Reference

• Microsoft update guidance for CVE-2026-64902 is available via Microsoft’s update guide page listed in the findings.

CVE-2026-64902 is classified under CWE-79 (improper neutralization of input during web page generation), which corresponds to cross-site scripting style behavior in the context of SharePoint page/script rendering. The reported capability is that an attacker with valid credentials can inject malicious script through a trusted interface so that it executes in a victim’s web browser session, enabling spoofing or manipulation of what users see and can do.

Exposure requirements from the findings:

• Authentication: an authenticated attacker with valid credentials (low privileges / authorized user) is required.
• Interaction: user interaction is required (a victim must view/interact with the injected content).

Exploitation status:

• No KEV entry was provided, and the supplied news material did not report exploitation of CVE-2026-64902 itself.
• No public exploit code was found in the provided findings.

Fixing:

• Microsoft has fixed all listed affected SharePoint branches in the versions provided (2016: 16.0.5565.1001; 2019: 16.0.10417.20198; Subscription/SharePoint baseline: 16.0.19725.20522).