CVE-2026-62826— Microsoft SharePoint Server Spoofing Vulnerability
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by CompromiseAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Microsoft | Microsoft SharePoint Enterprise Server 2016 | 16.0.0< 16.0.5561.1001 | affected |
| Microsoft | Microsoft SharePoint Server 2019 | 16.0.0< 16.0.10417.20175 | affected |
| Microsoft | Microsoft SharePoint Server Subscription Edition | 16.0.0< 16.0.19725.20434 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-62826
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Microsoft SharePoint Server Spoofing Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Microsoft Office Sharepoint Server 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Microsoft Office Sharepoint Server是美国Microsoft公司的一款为企业客户而设计的、基于web的内容管理和协作工具。该软件初始版本以Office组件形式存在,现在也仍然大大依托于Office,以提供企业门户、文档协同等功能为主,之后版本支持将Office、Exchange、Lync、Project和Visio结合起来。 Microsoft Office Sharepoint Server存在跨站脚本漏洞，该漏洞源于网页生成过程中输入中和不当（跨站脚本），可能导致授权攻
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Microsoft | Microsoft SharePoint Enterprise Server 2016 | 16.0.0 ~ 16.0.5561.1001 | - | |
| Microsoft | Microsoft SharePoint Server 2019 | 16.0.0 ~ 16.0.10417.20175 | - | |
| Microsoft | Microsoft SharePoint Server Subscription Edition | 16.0.0 ~ 16.0.19725.20434 | - |
II. Public POCs for CVE-2026-62826
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-62826
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-62826 (1)
Same Patch Batch · Microsoft · 2026-07-16 · 20 CVEs total
| CVE-2026-57206 | 8.6 HIGH | SimpleChat plugin validation endpoints missing authentication and authorization |
| CVE-2026-59117 | 7.5 HIGH | Windows Terminal Remote Code Execution Vulnerability |
| CVE-2026-53598 | 7.5 HIGH | Prompty: Arbitrary File Read via ${file:path} Reference Expansion |
| CVE-2026-59861 | 7.5 HIGH | Kiota: Code Generation Literal Injection in Kiota Ruby Generator |
| CVE-2026-59862 | 7.5 HIGH | Kiota: Code Generation Literal Injection in the Python Generator |
| CVE-2026-59867 | 7.1 HIGH | Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref |
| CVE-2026-58598 | 7.0 HIGH | Windows Backup Service Elevation of Privilege Vulnerability |
| CVE-2026-55440 | 6.5 MEDIUM | Microsoft UFO: COMMAND_RESULTS handler creates unowned sessions, allowing authenticated se |
| CVE-2026-58643 | 6.1 MEDIUM | Windows Admin Center Spoofing Vulnerability |
| CVE-2026-54568 | 4.3 MEDIUM | Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read |
| CVE-2026-57205 | 4.3 MEDIUM | SimpleChat: Authenticated users can access other users' profile metadata through user IDOR |
| CVE-2026-59860 | Kiota: XML Doc-Comment Newline Breakout Code Injection | |
| CVE-2026-59859 | Kiota: Code Generation Literal Injection in the PHP Generator | |
| CVE-2026-59863 | Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF | |
| CVE-2026-59865 | Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota i | |
| CVE-2026-59864 | Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions | |
| CVE-2026-59866 | Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clien | |
| CVE-2026-54733 | moodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpoin | |
| CVE-2026-53597 | Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader |
IV. Related Vulnerabilities
Same product: Microsoft SharePoint Enterprise Server 2016
- CVE-2026-58277
Microsoft SharePoint Elevation of Privilege Vulnerability - CVE-2026-56157
Microsoft SharePoint Server Spoofing Vulnerability - CVE-2026-55135
Microsoft SharePoint Server Spoofing Vulnerability - CVE-2026-55052
Microsoft SharePoint Elevation of Privilege Vulnerability - CVE-2026-55040
Microsoft SharePoint Server Security Feature Bypass Vulnerab
Same vendor: Microsoft
- CVE-2026-57990
Microsoft Edge (Chromium-based) Information Disclosure Vulne - CVE-2026-57989
Microsoft Edge (Chromium-based) Information Disclosure Vulne - CVE-2026-57978
Microsoft Edge (Chromium-based) Spoofing Vulnerability - CVE-2026-62835
Azure Portal Information Disclosure Vulnerability - CVE-2026-56163
Microsoft Azure Kubernetes Service Elevation of Privilege Vu
Same weakness: CWE-79
- CVE-2026-66031
Ekushey Project Manager CRM 5.0 Stored XSS via Reply Ticket - CVE-2026-66030
Ekushey Project Manager CRM 5.0 Stored XSS via Ticket Title - CVE-2026-66029
Ekushey Project Manager CRM 5.0 Stored XSS via Client Name F - CVE-2026-59239
Stored XSS in Prospero Flow CRM email body allows administra - CVE-2026-66390
Apache Wicket: crafted Link URL strings can break out of the
V. Comments for CVE-2026-62826
No comments yet