CVE-2026-45481: Microsoft Office SharePoint cross-site scripting

CVE-2026-45481 · Severity: high · CVSS 7.3 · Published 2026-06-09

Microsoft Office SharePoint, a widely used platform for document management and team collaboration, is affected by a security vulnerability that could allow an attacker to perform spoofing attacks. By exploiting this flaw, an authorized user could execute malicious scripts in another user's browser session, potentially leading to unauthorized access to sensitive documents or the theft of login credentials. This could compromise the integrity of corporate data and disrupt internal operations.

Technologies: Microsoft SharePoint. Vendors: Microsoft.

Quick answers

Is CVE-2026-45481 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45481 being exploited in the wild.
How severe is CVE-2026-45481?
High severity, with a CVSS score of 7.3, published 9 June 2026.
Which products and versions are affected?
Microsoft Office SharePoint.
Is there a fix for CVE-2026-45481?
A patch was published on 2026-06-09: Security updates were made available via the Microsoft Update Guide. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45481 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45481?
Check whether you run Microsoft SharePoint. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A cross-site scripting (XSS) vulnerability exists in Microsoft Office SharePoint due to improper neutralization of input during web page generation (CWE-79). An attacker with basic user permissions (PR:L) can exploit this by injecting malicious scripts into SharePoint pages. The attack requires a victim to interact with a compromised page or link (UI:R). Successful exploitation allows the attacker to perform spoofing, hijack user sessions, or access sensitive information within the context of the victim's browser. The vulnerability is addressed in the June 2026 Microsoft security updates.

Affected products

  • Microsoft Office SharePoint

Timeline

  • 2026-06-09: advisory: Microsoft published the security advisory and NVD entry.
  • 2026-06-09: patched: Security updates were made available via the Microsoft Update Guide.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.