CVE-2026-26105 is a high severity cross-site scripting flaw (CVSS 8.1) in Microsoft SharePoint Server that allows spoofing over a network. Microsoft's Security Update Guide holds the affected builds and update numbers, so apply the one it lists for your SharePoint version. The record does not list it in CISA's KEV catalog, and the sources we read do not report exploitation.
What's affected
- Microsoft SharePoint Server, per the record
- Specific builds and fixing updates: see the Microsoft Security Update Guide entry for the CVE
We could not read affected builds from Microsoft's page, so we will not state versions. The record's vector says no privileges are needed but a user must take part. Check the guide for the exact update for your SharePoint version.
How to check if you're exposed
Open the Microsoft Security Update Guide entry for the CVE and match your SharePoint Server version and build to the update it lists. In SharePoint Central Administration, the farm's patch status page shows the installed build numbers. Compare each server in the farm, because partial patching is common.
SharePoint Online is managed by Microsoft. The record names SharePoint Server, so check the guide for what applies to you.
What to do now
- Open Microsoft's entry for the CVE and note the update for your version.
- Test the update on a non production farm if you have one.
- Deploy it to every server in the farm and run the configuration wizard if the update notes require it.
- Confirm build numbers in Central Administration afterward.
- Remind users that links to internal sites from unexpected messages should be treated with care.
Why it matters
CWE-79 is cross-site scripting: the application includes input in a page without neutralizing it, so a browser may run script supplied by someone else in the context of a trusted site. For SharePoint, that context is an internal portal where users are logged in and where documents live.
Microsoft classes the effect as spoofing, which fits a case where the attacker aims to make a page act or look like something it is not. The vector needs user interaction, so the realistic path is getting a person to open a crafted link or page.
Cross-site scripting flaws in collaboration platforms are valuable to attackers because of the trust users place in the site. Patch promptly and keep defenses like a content security policy in place where you can.
Quick check
Where do I find the fixed build?
In the Microsoft Security Update Guide entry for this CVE. We did not read affected builds from it.
Why does the vector need user interaction?
The record shows user interaction required, which fits XSS: a person must load the crafted content.
Sources
Last reviewed: 19 October 2026.
