SharePoint: Patch for CVE-2026-55126, an Authenticated XSS Rated CVSS 8.1

On July 15, 2026, Trend Micro published advisory ZDI-26-418, concluding a coordinated disclosure that began on May 7 with Microsoft. The vulnerability affects the SPFieldMultiLineText class in SharePoint, enables cross-site scripting attacks with total impact on confidentiality and integrity, and carries a CVSS 8.1 score placing it in the High range. The real severity lies in a contradiction: Microsoft classifies it as 'Spoofing' with 'Exploitation Less Likely,' yet the attack vectors and the combination of AC:L (low attack complexity) and AV:N (network) make it more dangerous than the enterprise perception suggests.

The Mechanism: Missing Validation in the SPFieldMultiLineText Class

The SPFieldMultiLineText is a core class in SharePoint lists and libraries, responsible for managing fields that accept multi-line text input. According to the ZDI advisory, the flaw stems from the "lack of proper validation of user-supplied data," which allows the injection of arbitrary script into the web page generation flow.

"The specific flaw exists within the SPFieldMultiLineText class. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script." — ZDI Advisory ZDI-26-418

The payload executes in the security context of the user viewing the field. This means an attacker with basic user access—sufficient to create or modify a SharePoint item containing a multi-line field—can compromise sessions of users with higher privileges, including site administrators and owners, if they access the malicious content.

The Attack Vector: Low Technical Barrier, High Efficacy

The combination of AV:N (Attack Vector: Network) and AC:L (Attack Complexity: Low) indicates the exploit requires no special network conditions or advanced skills. The limiting factor is UI:R (User Interaction: Required): the victim must visit a page or open a malicious file. Microsoft notes in the advisory FAQ: "An authorized attacker must send the user a malicious link and convince the user to open it."

The PR:L (Privileges Required: Low) requirement confirms that administrative privileges are unnecessary: a standard user account with contribute permissions to a SharePoint list is sufficient. In enterprise environments with hundreds or thousands of users with contribute access, the attack surface is substantial. The S:U (Scope: Unchanged) value indicates the malicious code cannot extend beyond the victim's privileges, but with C:H and I:H the impact on confidentiality and integrity is total within that context.

The Classification Discrepancy: 'Spoofing' vs. CVSS 8.1

Microsoft describes CVE-2026-55126 as "Improper neutralization of input during web page generation ('cross-site scripting')" that "allows an authorized attacker to perform spoofing over a network." The choice of the term 'spoofing' has operational consequences: in automated enterprise patch prioritization systems, this classification can deprioritize the vulnerability compared to 'Remote Code Execution' or 'Elevation of Privilege.'

But the CVSS vector tells a different story. The 8.1 score is calculated on total impact on two of the three CIA triad axes, with remote access and low complexity. Exploitability (E:U, Exploit maturity: Unproven) and the 'Exploitation Less Likely' assessment reduce immediate risk, but do not negate the ease of exploitation once a proof-of-concept becomes available. ZDI coordinated disclosure for 69 days: the time between the initial report (May 7) and public release (July 15) suggests validation and remediation without hiccups, but provides no information on fix deployment across enterprises.

The editorial assessment is that the 'spoofing' classification understates the real risk profile. A stored or reflected XSS in SharePoint, executing in the context of the authenticated user, enables session theft, unauthorized content modification, and automated actions with the victim's privileges. These impacts exceed the narrow definition of spoofing (identity falsification) and align more closely with a functional compromise of the information system.

What to Do Now

• Verify application of the Microsoft patch for CVE-2026-55126 on all SharePoint installations, prioritizing servers with high numbers of contributing users or external network access.
• Check access logs for lists and libraries using multi-line fields to identify suspicious content modifications by users with basic privileges in the 69 days preceding July 15, 2026.
• Review SharePoint contribution policies to limit content creation permissions to users who actually require multi-line fields, reducing the injection surface.
• Assess the priority of CVE-2026-55126 in enterprise patching processes independently of the 'Spoofing' classification, calibrating on the CVSS 8.1 score and the AV:N/AC:L combination.

Frequently Asked Questions

Is the patch mandatory even with 'Exploitation Less Likely'?

The CVSS 8.1 and the technical ease of exploitation make the patch a priority. The exploitability assessment refers to the lack of public exploits at the time of publication, not to the code's resistance to reverse analysis.

Are multi-line text fields common in SharePoint?

The SPFieldMultiLineText class is among the most used standard field types in custom lists, document libraries, and workflows. Its prevalence makes the vulnerability particularly relevant for installations with extensive collaborative content.

Does the user interaction requirement make the attack unlikely?

UI:R limits scalability compared to a self-propagating worm, but does not eliminate the risk. Targeted social engineering tactics against SharePoint site administrators—high-value targets—can make interaction a manageable hurdle for determined attackers.

Information verified against cited sources and current as of publication.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-418/
• http://www.zerodayinitiative.com/advisories/published/
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55126