Overview of CVE-2026-80095: Stored Cross-Site Scripting in SharePoint Server Subscription Edition Enabling Elevation of Privilege

Introduction

A stored cross-site scripting flaw in SharePoint Server Subscription Edition lets a user who can edit page content plant script that runs when a colleague views and interacts with that page. Microsoft says successful exploitation could let the attacker act with the administrative privileges of the SharePoint farm service identity. That is why a bug class often dismissed as cosmetic carries a CVSS base score of 9.0 here.

CVE-2026-80095 was published on November 10, 2026 and fixed the same day in the SharePoint Server Subscription Edition cumulative update KB5002945. The input data listed the vendor as Unknown. The NVD record shows Microsoft Corporation as the CNA, and Microsoft publishes both the advisory and the update. Two severity labels apply. The Microsoft-supplied CVSS v3.1 base score is 9.0 (Critical), while the MSRC advisory classifies the issue as Important. At original publication, Microsoft reported the vulnerability as not exploited, not publicly disclosed, and "Exploitation Less Likely".

Technical information

Root cause

The NVD description reads: improper neutralization of input during web page generation (cross site scripting) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. The weakness is classified as CWE-79.

MITRE's description of CWE-79 explains the general mechanism: untrusted content reaches a web page and is delivered to another user, whose browser executes the malicious script within the web server's domain. In SharePoint's case, the relevant boundary is where stored page content is rendered into HTML. If user-supplied content is not encoded or sanitized before it reaches the page, the next viewer's browser can interpret it as active script rather than as inert data.

Microsoft's FAQ describes a stored XSS scenario:

• An authenticated attacker with permission to add or modify content on an affected SharePoint page stores malicious script in that page.
• When another user views and interacts with the affected content, the script could execute in that user's security context.
• The script could then access or modify SharePoint data available to that user.

Separately, the FAQ states: "Successful exploitation could allow an attacker to act with the SharePoint farm service identity's administrative privileges." Microsoft does not publish the intermediate implementation details connecting script execution in a viewer's browser to the farm service identity's privileges. Both statements are material, and we treat the administrative impact as Microsoft's stated outcome rather than something we can independently trace.

SharePoint Server is closed source, so there is no public commit or diff. Microsoft has not said which components, web parts or file types changed. The KB links to a CSV of every file in the package but does not flag which ones relate to this CVE, and no binary diff of the builds before and after the update had been published as of this writing.

CVSS scoring

The published base vector is:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

• AV:N, Attack vector: Network
• AC:L, Attack complexity: Low
• PR:L, Privileges required: Low
• UI:R, User interaction: Required
• S:C, Scope: Changed
• C:H / I:H / A:H, Confidentiality, integrity and availability impact: High

These values come from Microsoft's CNA assessment. NVD had not supplied its own score in the reviewed record. The MSRC temporal vector ends in RL:O (Official Fix), and the advisory assigns exploit code maturity Unproven, which brings the temporal score to 7.8. The changed scope is how the score expresses the jump from content editor to a viewer's session and, per Microsoft, to farm service identity privileges.

Attack flow

Based on Microsoft's advisory, the documented scenario proceeds as follows:

1. The attacker holds an authenticated account with rights to add or modify content on an affected SharePoint page (PR:L).
2. The attacker stores malicious script in that page content, which SharePoint fails to neutralize when generating the page.
3. Another user browses to the page and interacts with the affected content (UI:R).
4. The script executes in that user's browser, in the user's security context within the SharePoint origin, and can access or modify SharePoint data available to that user.
5. According to Microsoft, successful exploitation could ultimately let the attacker act with the SharePoint farm service identity's administrative privileges.

What the sources do not establish

The advisory explicitly states that the Preview Pane is not an attack vector. It does not identify a vulnerable URL, parameter, payload, browser requirement, or reproducible exploit sequence. The classification is elevation of privilege, not remote code execution. The available sources establish neither unauthenticated exploitation nor operating system code execution. This is not the unauthenticated attack pattern associated with some earlier SharePoint incidents.

Exploitation status

Microsoft's exploitability assessment reflects the time of original publication. It lists Publicly disclosed as No, Exploited as No, and the rating as Exploitation Less Likely. The CVE does not appear in CISA KEV catalog version 2026.11.10, but that feed was released at 2026-11-10T19:03:29Z, before the NVD publication timestamp of 2026-11-10T19:21:22, so its absence says little about the period after disclosure. No threat actor attribution exists for this CVE. Microsoft acknowledges Genwei Jiang with Google Cloud, FLARE OTF for the report, which is a research credit rather than malicious attribution.

Patch information

Microsoft fixed CVE-2026-80095 in the November 10, 2026 security update for SharePoint Server Subscription Edition, KB5002945. The fixed build is 16.0.20326.20278.

How the fix was shipped

• Vehicle: KB5002945 is a SharePoint cumulative update. The KB article lists CVE-2026-80095 first among about 24 CVEs it resolves, alongside SharePoint information disclosure, RCE, spoofing, security feature bypass and Word RCE bugs. The XSS fix cannot be installed on its own. You get it by moving the farm to the new build.
• Fixed build: The MSRC Security Update Guide gives 16.0.20326.20278 for SharePoint Server Subscription Edition, matching the excluded upper bound in the NVD affected range. Any farm at this build or later has the fix.
• Vendor status: The temporal vector's RL:O means "Official Fix", which MSRC defines as "A complete vendor solution is available."
• Supersedence: KB5002945 replaces KB5002927. A farm on KB5002927 or earlier is still vulnerable.
• Package: The Download Center offers a single file, uber-subscription-kb5002945-fullfile-x64-glb.exe (about 1.6 GB, for Windows Server 2019 and 2022). The KB lists its SHA256 as 31B944695F41590F52167E59EC3BF09DEA0590C9546C08D681607CE80E14F0E6, so you can verify file integrity before deployment. The Download Center text about code running when a "maliciously modified file is opened" is Microsoft's standard wording for Office updates and does not describe this XSS bug.

Obtaining the update

1. Microsoft Update, installed automatically if automatic updating is enabled.
2. Microsoft Update Catalog, as a standalone package (search for KB5002945).
3. Microsoft Download Center, download ID 108898.

Prerequisites and side effects

• Workflow Manager: If the farm runs SharePoint Workflow Manager, install KB5002799 before this cumulative update.
• Classic Workflow Manager: Farms still using the Classic version must enable server debug flag 53601 to keep it working. The KB provides this PowerShell:

$farm = Get-SPFarm
$farm.ServerDebugFlags.Add(53601)
$farm.update()
iisreset

• Nonsecurity changes: The update includes a fix for the Search Host Controller service and time zone updates. Microsoft has also moved the planned blocking of remote event receivers that lack an app identity to the March 2027 Public Update. Validate these in staging before production rollout.

Verifying the fix

Confirm that every server in the farm reports build 16.0.20326.20278 or later, for example under Servers in Farm in Central Administration or with (Get-SPFarm).BuildVersion. Seeing the package installed on a single server is not sufficient.

Microsoft publishes no CVE-specific workaround. MITRE's general CWE-79 guidance (context-appropriate output encoding, separation of data from code, strict input validation) applies to application development and is not a substitute for the SharePoint update.

Affected systems and versions

• Product: Microsoft SharePoint Server Subscription Edition
• Platform: x64
• Affected range: versions from 16.0.0 up to, but excluding, 16.0.20326.20278 (CNA record on NVD: 16.0.0 < 16.0.20326.20278)
• Fixed in: 16.0.20326.20278, delivered by KB5002945
• Still vulnerable: farms at KB5002927 or earlier
• Exploitation preconditions: an authenticated account with permission to add or modify content on an affected page, plus a victim who views and interacts with that content

The published product record lists only SharePoint Server Subscription Edition, and we do not extend the affected list beyond it.

Vendor security history

SharePoint Server has been a frequent target in recent years. In July 2025, Microsoft documented active exploitation of on-premises SharePoint involving CVE-2025-49706 and CVE-2025-49704, with related vulnerabilities CVE-2025-53770 and CVE-2025-53771, and released security updates for supported SharePoint Server versions. Microsoft observed Linen Typhoon and Violet Typhoon exploiting those vulnerabilities, and Storm-2603 using them to deploy ransomware starting July 18, 2025.

That incident also showed the limits of patching after compromise. CISA warned that malicious modules could persist and reload after an IIS restart unless their configuration entries were removed, and Microsoft issued incident-specific guidance such as machine key rotation. Those measures and that attribution belong to the 2025 vulnerability set, not to CVE-2026-80095. What carries over is the context: SharePoint Server attracts serious attention, and Microsoft has an established advisory and cumulative update process for addressing it.

References

• MSRC Security Update Guide: CVE-2026-80095
• NVD: CVE-2026-80095
• NVD CVE API record for CVE-2026-80095
• Microsoft Support: Security update for SharePoint Server Subscription Edition, November 10, 2026 (KB5002945)
• Microsoft Download Center: KB5002945 package
• Zero Day Initiative: The November 2026 Security Update Review
• Stefan Goßner: SharePoint security fixes released with November 2026 PU
• Microsoft Learn: SharePoint updates release notes
• Microsoft Learn: Install a software update for SharePoint Server
• MITRE CWE-79: Improper Neutralization of Input During Web Page Generation
• CISA Known Exploited Vulnerabilities Catalog
• CISA KEV JSON feed
• Microsoft Security Blog: Disrupting active exploitation of on premises SharePoint vulnerabilities (July 2025)
• CISA: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities (July 2025)
• Microsoft Inside Track: 25 Years of SharePoint at Microsoft
• Microsoft 365 Blog: Over 200 million users rely on SharePoint (2020)