## Summary
CVE-2026-70355 describes cross-site scripting (CWE-79) in Microsoft Office SharePoint that can be triggered by an authorized attacker. The issue can enable privilege elevation across a network.
## Technical Details
- Vulnerability class: Improper neutralization of input during web page generation ('cross-site scripting')
- CWE: CWE-79
- CVSS (provided): 7.3 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
- Attack characteristics (provided):
- Network-based (AV:N)
- Low complexity (AC:L)
- Requires privileges (PR:L)
- Requires user interaction (UI:R)
## Affected
- Microsoft Office SharePoint (exact affected versions not provided in the available data)
## Impact
- Confidentiality impact: C:H
- Integrity impact: I:H
- Availability impact: A:N
- The NVD description specifically states the XSS can allow an authorized attacker to elevate privileges over a network.
## Mitigation
1. Apply Microsoft’s security update/patch for the affected SharePoint component(s) as soon as available.
2. Reduce the number of users with PR:L-level access to SharePoint sites where the issue may be reachable.
3. Enforce browser-side and application-side protections that mitigate XSS (e.g., strict input validation and output encoding), and review custom pages/web parts for unsafe rendering patterns.
4. Monitor for suspicious script execution and anomalous privilege changes following user interaction events.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CWE-79