CVE-2026-70306: Microsoft Office SharePoint Spoofing Vulnerability

CVE-2026-70306 is a spoofing vulnerability in Microsoft Office SharePoint, rated Important by Microsoft, with a CVSS 3.1 base score of 9.3 (Critical). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 1.01% probability of exploitation activity in the next 30 days, higher than 63% of all scored vulnerabilities. Microsoft released the fix on 11 August 2026 in the August 2026 Patch Tuesday, delivered through 3 security updates (KB5002905, KB5002894, KB5002893). It affects 3 products in 1 product family (Microsoft Office).

Key facts

CVE ID: CVE-2026-70306
Severity: Critical CVSS 9.3
Microsoft severity: Important
Impact: Spoofing
Exploited in the wild: No
Publicly disclosed: No
Exploitation likelihood: Less Likely
Weakness: CWE-79
EPSS: 1.01% (percentile 63%)
CISA KEV: Not listed
Released: 11 August 2026
Last updated: 11 August 2026
Patch Tuesday: August 2026 Patch Tuesday
Product families: Microsoft Office

From the August 2026 Patch Tuesday briefing

Microsoft Office SharePoint Spoofing Vulnerability

This Critical Spoofing vulnerability in SharePoint is CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N and is associated with CWE-79 (XSS). The scenario is classic enterprise targeting: an attacker crafts SharePoint content or a link that, when opened by a user, triggers script execution in a context that enables credential theft, session hijacking, or UI redressing, and because scope changes, the blast radius can extend beyond a single site context depending on tenant configuration and trust relationships.

From the briefing, written by an AI model from PatchaPalooza's data.

CVSS score and vector

Microsoft scores CVE-2026-70306 at 9.3 (temporal 8.1) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C

Metric	Value
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Changed
Confidentiality impact	High
Integrity impact	High
Availability impact	None
Exploit code maturity	Unproven
Remediation level	Official fix
Report confidence	Confirmed

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Frequently asked questions (Microsoft)

How could an attacker exploit this vulnerability?

An attacker could send a specially crafted URL to an authenticated SharePoint user and persuade them to visit it and submit the form. Successful exploitation could allow the attacker to run script in the user's SharePoint session, potentially accessing information or modifying site content.

Affected products (3)

Microsoft Office

Product	Security update	Type	Fixed build	Restart
Microsoft SharePoint Enterprise Server 2016	KB5002905	Security Update	16.0.5565.1001	Maybe
Microsoft SharePoint Server 2019	KB5002894	Security Update	16.0.10417.20198	Maybe
Microsoft SharePoint Server Subscription Edition	KB5002893	Security Update	16.0.19725.20522	Maybe

Security updates (3)

KB5002905 (Security Update)
KB5002894 (Security Update)
KB5002893 (Security Update)

NIST NVD data

NVD status: Analyzed
NVD CVSS: 9.3 (CRITICAL)
NVD weakness: CWE-79
Published to NVD: 11 August 2026
NVD last modified: 13 August 2026

Affected configurations (CPE)

Product	Vulnerable versions
sharepoint server	before 16.0.19725.20434
sharepoint server 2016	all listed versions
sharepoint server 2019	all listed versions

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70306 (Vendor Advisory, Patch)

Acknowledgments

Revision history

Version	Date	Description
1.0	11 August 2026	Information published.