CVE-2025-64672
published 2025-12-09CVE-2025-64672: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…
PriorityP345critical9CVSS 3.1
AVNACLPRLUIRSCCHIHAH
EPSS
1.03%
59.7th percentile
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sharepoint_server_subscription_edition | >= 16.0.0 < 16.0.19127.20378 | 16.0.19127.20378 |
| microsoft | sharepoint_server | < 16.0.19127.20378 | 16.0.19127.20378 |
| msrc | microsoft_sharepoint_server_subscription_edition | — | — |
CVSS provenance
nvdv3.19.0CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Microsoft SharePoint Server Spoofing Vulnerability
vendor_msrc·2025-12-09·CVSS 8.8
CVE-2025-64672 [HIGH] CWE-79 Microsoft SharePoint Server Spoofing Vulnerability
Microsoft SharePoint Server Spoofing Vulnerability
Description: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
FAQ: According to the CVSS metric, the attack vector is network (AV:N) and the attack complexity is low (AC:L). What does that mean for this vulnerability?
The attack vector is Network (AV:N) because this vulnerability is remotely exploitable and can be exploited from the internet. The attack complexity is Low (AC:L) because an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component.
Microsoft Office SharePoint: Microsoft Office SharePoint
Microsoft
GHSA
GHSA-c834-93jr-pfcj: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to p
ghsa_unreviewed·2025-12-09
CVE-2025-64672 [HIGH] CWE-79 GHSA-c834-93jr-pfcj: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to p
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Microsoft December 2025 Patch Tuesday fixes 3 zero-days, 57 flaws
blogs_bleepingcomputer·2025-12-09·CVSS 7.8
[HIGH] Microsoft December 2025 Patch Tuesday fixes 3 zero-days, 57 flaws
## Microsoft December 2025 Patch Tuesday fixes 3 zero-days, 57 flaws
## Lawrence Abrams
28 Elevation of Privilege Vulnerabilities
19 Remote Code Execution Vulnerabilities
4 Information Disclosure Vulnerabilities
3 Denial of Service Vulnerabilities
2 Spoofing Vulnerabilities
When BleepingComputer reports on Patch Tuesday security updates, we only count those released by Microsoft today. Therefore, the number of flaws does not include Microsoft Edge (15 flaws) and Mariner vulnerabilities fixed earlier this month.
To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5072033 & KB5071417 cumulative updates .
If you're facing delays, blind spots, or prioritization issues with Patch Tuesday updates, our recent webinar with
Wiz
CVE-2025-64672 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2025-64672 [HIGH] CVE-2025-64672 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-64672 :
Microsoft SharePoint Server Subscription Edition vulnerability analysis and mitigation
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Source : NVD
## 9
Score
Published December 9, 2025
Severity CRITICAL
CNA Score 8.8
Affected Technologies
Microsoft SharePoint Server Subscription Edition
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 14.4
Exploitation Probability (EPSS) N/A
Affected packages and libraries
cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*
Sources
Windows Severity CRITICAL Has Fix Added at: Jan 23,
2025-12-09
Published