CVE-2026-70355 is a high severity (CVSS 7.3) cross-site scripting flaw in Microsoft SharePoint Server. An authorized attacker can elevate privileges over a network, and a user has to interact. The fix is the SharePoint security update named in the Microsoft Security Response Center entry for your edition.
What's affected
The record names Microsoft SharePoint Server and gives no editions or build numbers. The MSRC page loads by script, so I could not read its table. Confirm affected and fixed builds there.
The weakness is CWE-79, improper neutralization of input during web page generation. The vector is AV:N/AC:L/PR:L/UI:R/S:U: network reachable, low complexity, a low privilege account, and a user who must act, such as opening a crafted page. Confidentiality and integrity impacts are high, availability none.
SharePoint Online is updated by Microsoft. This applies to the self-hosted server product, so check which one you have.
How to check if you're exposed
On SharePoint Server, the build number is shown in Central Administration under the farm information page, or through PowerShell on a farm server:
(Get-SPFarm).BuildVersion
Compare it with the fixed build in MSRC. Patch every server in the farm, because a mixed farm is a common cause of failed updates and errors.
Because the flaw needs a signed in account, look at who can create or edit content. Site owners and contributors can place content that other users view. Review these roles on sites with wide audiences.
free in-browser dependency scan helps with custom web parts and add-ins that you build, though the server patch comes from Microsoft.
What to do now
- Open the MSRC entry for CVE-2026-70355 and find the update for your SharePoint Server edition.
- Check the farm build number against the fixed build.
- Install the update on all farm servers and run the configuration wizard as Microsoft instructs.
- Review who has contribute or edit rights on widely viewed sites.
- Check that a content security policy and output encoding are applied in your custom web parts.
Why it matters
CWE-79 is the best known web flaw class: an application writes input back into a page without making it safe, so the browser runs it as script in the victim's session. In a collaboration platform the effect is larger than on a brochure site. The script runs with the victim's rights, and if the victim is an administrator, the attacker gains those rights.
That is why a cross-site scripting flaw can carry the description of privilege elevation. The user interaction requirement lowers the score but does not remove the risk, since a link in a message is enough for many users.
Quick check
Does this affect SharePoint Online?
The record names SharePoint Server. Microsoft maintains the online service itself. Check the MSRC entry if you are unsure about your deployment.
Sources
Last reviewed: 18 October 2026.
