CVE-2025-64672 is a high severity (CVSS 8.8) cross-site scripting flaw in Microsoft SharePoint Server, published on 9 December 2025. An authorized attacker can perform spoofing over a network. Microsoft's data says customer action is required, so apply the security update listed in the update guide.
What's affected
The NVD record names the product as Microsoft Office SharePoint and describes improper neutralization of input during web page generation, which allows an authorized attacker to perform spoofing over a network. It does not list builds.
Microsoft's update guide entry is titled "Microsoft SharePoint Server Spoofing Vulnerability" and states that customer action is required. It lists the issue as part of the December 2025 release, not publicly disclosed and not exploited at publication, with an exploitability assessment of "Exploitation Less Likely". Microsoft rates it Important. The exact builds and update package names are on the advisory page and change by SharePoint edition, so read them there rather than relying on a summary.
How to check if you're exposed
SharePoint Server is self hosted, so you do have a version to check. In the SharePoint Management Shell, read your farm build:
(Get-SPFarm).BuildVersion
Get-SPProduct -Local | Select-Object -ExpandProperty PatchableUnitDisplayNames
Then open the MSRC page for CVE-2025-64672 and compare your edition and build with the security update listed for it. Central Administration also shows the patch status under Upgrade and Migration. If you have not installed the December 2025 security updates, you are likely still exposed, but confirm with the table on the advisory page.
What to do now
- Open the MSRC page for CVE-2025-64672 and note the update for your SharePoint edition.
- Install the update on every server in the farm and run the configuration wizard as Microsoft instructs.
- Limit who can create and edit content, because the attacker must be authorized.
- Review recent content for odd markup in places users can edit, and remove it.
- Confirm the new build in the farm and record it in your inventory.
Why it matters
The record lists CWE-79, cross-site scripting. Input is placed into a page without being made safe, so the browser may treat it as code. In SharePoint, where users edit and share content with colleagues, this can let one authorized user act as another.
The vector shows low privileges and no user interaction, with high impact on confidentiality, integrity and availability. Microsoft's data says the flaw was not exploited at publication and is less likely to be exploited. The record does not list it in the CISA Known Exploited Vulnerabilities catalog. Even so, on a collaboration platform that holds company documents, a patch cycle should not slip.
Quick check
Do I need to act on this one?
Yes if you run SharePoint Server. Microsoft's data says customer action is required.
Is the flaw exploited?
Microsoft's entry says not exploited at publication, and it is not listed as known exploited in the record.
Sources
Last reviewed: 18 October 2026.
