{"id":"CVE-2026-109454","published":"2026-11-10T19:18:14.347","lastModified":"2026-11-10T21:18:04.087","description":"Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.","cvssScore":9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109454","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint allows an authenticated attacker to inject malicious scripts into web pages served to other users, enabling credential theft or account takeover via spoofed UI elements.","exploitability":"Exploitation requires low skill and only a valid low-privileged user account plus social engineering to trigger the payload (e.g.,诱使 victim click a crafted link); no special tools are needed.","blast_radius":"Successful exploitation could lead to widespread compromise of internal users’ sessions, data exfiltration from SharePoint, or lateral movement within the organization via compromised accounts.","remediation":"Apply Microsoft security update MS26-XXXXX (specific patch for CVE-2026-109454) released on [date]; if unavailable, restrict SharePoint access to trusted networks and disable custom script execution via SharePoint Admin Center settings until patched.","detection":"Monitor SharePoint ULS logs for HTTP POST requests containing unencoded script tags or event handler attributes (e.g., 'onerror=', 'onclick=') in form fields submitted by low-privileged users; also watch for anomalous outbound requests from SharePoint servers to external domains in user-agent or referrer headers.","tags":["xss","spoofing","web","sharepoint","session-theft"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:59:04.181Z"}}