A cross-site scripting vulnerability in Microsoft SharePoint Server Subscription Edition, rated CVSS 9.0 (Critical), lets an authorized attacker elevate privileges over a network.
What Is It
CVE-2026-80095 is an improper neutralization of input during web page generation (cross-site scripting, CWE-79) in Microsoft Office SharePoint. Microsoft's description says an authorized attacker can use the flaw to elevate privileges over a network.
Microsoft published the CVE on November 10, 2026. NVD lists its status as "Awaiting Analysis," so NVD has not yet added its own enrichment.
Why It Matters
Microsoft assigned a CVSS 3.1 base score of 9.0 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H:
- Network attack vector, low complexity: The flaw can be exploited remotely, and the attack is not complex.
- Low privileges required: The attacker needs an authorized account, but only a low-privileged one.
- User interaction required: A victim must take some action for the attack to succeed, which fits a cross-site scripting flaw.
- Scope changed: A successful attack can affect resources beyond the vulnerable component.
- High impact: Confidentiality, integrity, and availability are all rated High.
The exploitability subscore is 2.3 and the impact subscore is 6.0. The scope change and full CIA impact explain why this XSS issue is rated Critical.
Exploitation status: CVE-2026-80095 is not in the supplied CISA Known Exploited Vulnerabilities (KEV) data. The source material does not confirm active exploitation, and there is no KEV remediation deadline. Readers can check the current CISA KEV catalog (linked in Sources) to see whether that has changed.
What's Vulnerable
According to Microsoft's affected-product data:
- Product: Microsoft SharePoint Server Subscription Edition
- Platform: x64-based systems
- Affected versions: 16.0.0 up to, but not including, 16.0.20326.20278
NVD has not listed any CPEs for this CVE yet.
Patch Status
The affected range ends below build 16.0.20326.20278, so builds at or above that version fall outside the vulnerable range. Administrators of SharePoint Server Subscription Edition should:
- Check their current build against 16.0.20326.20278.
- Get the security update and deployment guidance from the Microsoft Security Response Center (MSRC) advisory for this CVE.
The supplied KEV data has no CISA-mandated required action or due date.