CVE-2026-102859: Microsoft Office SharePoint Spoofing Vulnerability

For IT administrators managing enterprise document repositories and intranet portals, understanding the exact mechanics of this vulnerability and applying KB5002927 to reach fixed build 16.0.20326.20190 is essential to maintaining a clean security posture.

Vulnerability Overview and Official Status​

According to the Microsoft Security Response Center (MSRC) advisory, the core description for CVE-2026-102859 states:

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Click to expand...

Microsoft's official advisory facts highlight two key points regarding the flaw:

• Microsoft Office SharePoint Spoofing Vulnerability: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
• Is the Preview Pane an attack vector for this vulnerability? No, the Preview Pane is not an attack vector.

Below is the complete breakdown of the official metrics, status flags, and weakness classifications assigned to CVE-2026-102859:

• CVE ID: CVE-2026-102859
• Title: Microsoft Office SharePoint Spoofing Vulnerability
• Severity: Important
• CVSS Base Score: 4.6
• CVSS Temporal Score: 4.0
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C
• Weakness (CWE): CWE-79
• Exploitation Assessment: Exploitation Less Likely
• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

Section Summary: CVE-2026-102859 is an Important cross-site scripting (CWE-79) vulnerability with a CVSS base score of 4.6 and a temporal score of 4.0, where customer patching is required even though the Preview Pane is not an attack vector.

Technical Analysis: Deconstructing the CVSS Vector and CWE-79​

Why does a cross-site scripting flaw carry an Important severity rating while simultaneously holding a 4.6 base score? Synthesizing from general industry knowledge of the Common Vulnerability Scoring System (CVSS) v3.1 standard and web application security, the answer lies in the interplay between attacker prerequisites and business context.

Examining the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C reveals the exact operational boundaries of this vulnerability:

1. Attack Vector (AV:N) and Attack Complexity (AC:L): The flaw is exploitable over a network without requiring specialized conditions or convoluted timing.
2. Privileges Required (PR:L): An unauthenticated passerby cannot trigger this vulnerability. The attacker must already be an authorized user with low-level privileges on the SharePoint environment.
3. User Interaction (UI:R): Exploitation is not automatic; a targeted user must interact with the crafted element or visit a specific link or page where the unneutralized input is rendered. Because the advisory explicitly notes that the Preview Pane is not an attack vector, simply previewing a document in a pane will not trigger the payload.
4. Scope (S:U) and Impact (C:L/I:L/A:N): The scope remains unchanged, and impact is limited to low confidentiality and low integrity loss, with no impact on system availability (A:N).
5. Temporal Metrics (E:U/RL:O/RC:C): Exploit code maturity is unproven (E:U), an official remediation level is available (RL:O), and report confidence is confirmed (RC:C), bringing the temporal score to 4.0.

Because CWE-79 involves improper neutralization of input during web page generation, an authenticated user could inject script or markup that executes or renders within another user's browser session when viewing the affected SharePoint page. In an enterprise collaboration suite, spoofing over a network allows an attacker to present misleading interface elements, falsify displayed intranet content, or trick a colleague into trusting unauthorized prompts within the context of their browser session.

Section Summary: While low privilege requirements (PR:L) and mandatory user interaction (UI:R) keep the CVSS score moderate and the assessment at Exploitation Less Likely, the ability for an authenticated insider or compromised account to spoof content inside an enterprise portal warrants timely remediation.

Affected Products and Remediation Guide​

Microsoft has provided a direct update path for administrators running the affected on-premises server software. Review the table below to verify your environment's target patch level:

Practical Administration Notes​

Based on general industry knowledge of SharePoint Server administration, deploying updates to a SharePoint farm requires a coordinated maintenance window:

• Verify Current Build Numbers: Before deploying KB5002927, administrators should check Central Administration under System Settings > Manage servers in this farm to inspect the current configuration database version and identify any servers lagging below build 16.0.20326.20190.
• Binary Installation vs. Configuration Wizard: Installing the KB5002927 package places the updated binaries on the server, but SharePoint updates generally require running the SharePoint Products Configuration Wizard (PSConfig.exe or PSConfigUI.exe) across farm nodes to complete schema and service upgrades and fully register build 16.0.20326.20190.
• Defense in Depth: While Publicly disclosed: No and Exploited: No give patch management teams breathing room to test KB5002927 in a staging farm first, Customer action required: Yes means this update should be included in your standard October patch cycle.

Section Summary: Administrators operating Microsoft SharePoint Server Subscription Edition (x64) must fulfill the official remediation requirement: For Microsoft SharePoint Server Subscription Edition (x64), install KB5002927 to reach fixed build 16.0.20326.20190.