CVE-2026-70355

This vulnerability lets someone with a limited SharePoint account trick SharePoint into running malicious code inside a web page. If the victim’s browser loads that page (user interaction), the attacker can use it to gain higher permissions—like becoming an administrator within the SharePoint system. Think of it like leaving a door unlocked and handing a key to anyone who can reach the front desk, then using that key to open the manager’s office.

This matters if your organization runs Microsoft SharePoint Server 2019 or Microsoft SharePoint Server Subscription Edition (or SharePoint Server) and users can reach SharePoint pages that process web input. The weakness requires an attacker to already have low-level SharePoint credentials, plus some user interaction, so it’s most relevant when attackers can obtain a basic account or otherwise get a user to view a malicious page. Final reachability gate: it’s a risk only if an attacker can authenticate to SharePoint with low-level credentials and can involve user interaction (for example, getting a user to load the crafted content).

This is RED because attackers with at least low-level SharePoint access can potentially escalate to higher administrative permissions by injecting malicious scripts through web inputs. Even without public exploit code on record, the presence of credible threat-actor interest (Lazarus group) and the availability of an official patch mean you should treat this as an active, high-priority hardening task. Patch as soon as your change window allows.

Confirm exposure

• Identify which product you run: Microsoft SharePoint Server 2019 or Microsoft SharePoint Server Subscription Edition (or your environment is labeled as SharePoint Server).
• Determine your current SharePoint build/patch level (the installed SharePoint build number).
• If your build is older than the fixed versions below, you should assume you’re affected.

Apply the fix

• Microsoft SharePoint Server 2019: upgrade to 16.0.10417.20198 or later.
• Microsoft SharePoint Server Subscription Edition / SharePoint Server: upgrade to 16.0.19725.20522 or later.

If patching is delayed (temporary risk reduction)

• Reduce low-level SharePoint account exposure: remove unused accounts, restrict who can create or interact with content that leads to web pages receiving user-controlled input.
• Enforce least privilege on SharePoint roles so that “low-level” accounts cannot easily perform sensitive actions even if scripting is possible.
• Tighten monitoring for unexpected behavior: privilege/role changes and suspicious content/script activity around user sessions.

What to monitor after upgrading

• Logs for unusual script-like payloads in SharePoint page-related activity.
• Any unexpected permission/role escalations.
• Access patterns that look like repeated probing attempts by the same accounts.

KEV / exploit status

• This issue is not listed in the CISA KEV feed based on the provided findings.
• No dated press exploitation claim and no public exploit code were found in the provided findings. (However, patching is still warranted due to threat-actor interest and the high impact nature.)

Due date

• No CISA due date was provided in the findings.

Severity is rated HIGH (CVSS 7.3). The core mechanism is cross-site scripting (CWE-79) caused by improper neutralization of untrusted web inputs during page generation; this allows an authenticated attacker with low-level credentials to inject malicious scripts and leverage user interaction to elevate privileges within Microsoft SharePoint Server. The attack is network-based, but practical exploitation depends on the reachability gate: attacker authentication plus user interaction.

Exploitation maturity (from provided findings):

• KEV: not listed.
• News: no clear dated exploitation claim.
• Exploit code: none publicly recorded.
• Threat interest: press attention indicates patch-related activity with Lazarus group.

Patch guidance: fixed builds are available—16.0.10417.20198 for SharePoint Server 2019 and 16.0.19725.20522 for SharePoint Server Subscription Edition / SharePoint Server.