VYPR
← All advisories
Medium severity4.6NVD Advisory· Published Jan 13, 2026· Updated Jun 17, 2026

CVE-2026-20959

CVE-2026-20959

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Affected products

7
  • Microsoft/Sharepoint Servercpe-rescue5 versions
    16.0.0+ 4 more
    • (no CPE)range: 16.0.0
    • (no CPE)range: 16.0.0
    • cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*range: <16.0.19127.20442
    • cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*
  • Microsoft/Office SharePointcpe-rescue2 versions
    16.0.0+ 1 more
    • (no CPE)range: 16.0.0
    • (no CPE)

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.