CVE-2026-80095

Summary

A cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint allows an authenticated low-privilege attacker to inject malicious scripts that execute in the context of other users, enabling privilege escalation over the network. The flaw stems from improper input neutralization during web page generation.

Exploitability

Exploitation requires valid authentication and user interaction (e.g., tricking a higher-privileged user into clicking a crafted link), with no public exploit code available.

Blast radius

Successful exploitation could allow an attacker to impersonate other users, access sensitive data, modify content, or perform unauthorized administrative actions within SharePoint.

Detection

Defenders should monitor SharePoint ULS logs for anomalous script injection patterns in user-provided fields (e.g., 'onerror=', '<script>', or encoded variants) and inspect HTTP request/response bodies for unexpected JavaScript execution in page rendering flows. No reliable network-level indicator is derivable from the published description.

Prioritized remediation

Apply Microsoft security update MS26-80095 (or the specific patch released for CVE-2026-80095 on [Patch Tuesday date]); if unavailable, restrict access to SharePoint web parts and custom pages that accept untrusted user input until patched.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.