CVE-2026-64922

This flaw lets a user who can already log into SharePoint change what other people see—like swapping a trusted page for something that looks normal but causes users to click or load harmful content. Think of it like a business bulletin board where someone with basic access can put up a fake notice that tricks coworkers. In this case, the likely outcomes are limited data exposure and small changes to records, not total takeover.

This matters if you run Microsoft SharePoint Server (SharePoint Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition) and your SharePoint is reachable and used by multiple people. Because the attacker needs to be authenticated at a low level, the risk is highest if an attacker could log in as a user who can influence page content. The vulnerability is a risk in default configurations because it’s reachable, but the main gate is that the attacker must already have authenticated access and then trick other users into interacting with the changed content.

This is RED because the weakness is reachable in default configurations and can be triggered by an authenticated (low-level) user to trick other users. While there’s no clear, dated public exploitation report tying to CVE-2026-64922 in the provided news, Microsoft has released fixed versions and this is being tracked with active patch-driven attention. Treat it as urgent to close the gap, especially if you have users or accounts that could be abused.

1. Confirm exposure (inventory + version check)

• Identify which product you run: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition.
• Determine your current SharePoint build/version.

2. Determine whether you’re affected

• You are affected if your build is below the fixed build for your branch:
  • SharePoint Server 2016: fixed in 16.0.5565.1001
  • SharePoint Server 2019: fixed in 16.0.10417.20198
  • SharePoint Server Subscription Edition: fixed in 16.0.19725.20522

3. Patch

• Apply the official Microsoft update for CVE-2026-64922 using the MSRC update guide provided by Microsoft.
• Plan for normal maintenance behavior expected for SharePoint updates (test in a staging environment if you have one).

4. Temporary workaround (if patching must be delayed)

• Reduce the chance an attacker can create or modify content that others view: tighten SharePoint permissions so only the smallest necessary group can create/edit pages or content.
• Monitor for unexpected page/content changes by low-privileged users.

5. Validate after updating

• Re-check the SharePoint version to confirm you reached the fixed build.
• Review recent page modifications and scripting/content changes in SharePoint areas where users can contribute content.

6. What to monitor after remediation

• Look for unusual page edits, unexpected content changes, or patterns of user interaction with newly changed pages.
• If your environment supports it, correlate SharePoint activity logs to user accounts, especially low-privileged accounts.

Severity is assessed as medium by the provided score, but the practical risk includes authenticated webpage spoofing that can trick other users into interacting with malicious page content.

Mechanism/weakness: The issue is classified under CWE-79 (improper neutralization during web page generation), consistent with cross-site scripting-style behavior. Findings describe it as a network-reachable spoofing condition where an authenticated low-privileged person can execute script/content that tricks other users.

Attack prerequisites and reachability: Low-level authentication is required; user interaction is required (victims must interact with the page/content). The findings also state it is reachable in default configuration.

Exploitation status: No confirmed KEV listing. The provided press/news did not claim exploitation for CVE-2026-64922; they discussed other CVEs instead.

Patch: Microsoft provides fixed builds per product line (2016/2019/Subscription Edition) via the MSRC update guide.

EPSS: A prediction is provided (trend flat). Since no KEV/news confirmation of exploitation for this exact CVE is included in the provided findings, the EPSS figure is not used to drive public prioritization.

Actor/pattern note: The PULSE notes patch-related attention with Lazarus group, but no direct, CVE-specific exploitation claim is provided in the findings.