CVE-2026-64897

The EPSS score of 0.00283 on this SharePoint XSS isn't a signal of low risk — it's evidence that EPSS measures external opportunistic exploitation, not the threat model this vulnerability actually presents. The 'authorized attacker' qualifier means the adversary already holds legitimate SharePoint access, bypassing the barrier that EPSS tracks. A low exploitation probability from automated scanners tells you nothing about an attacker who's already inside the trust boundary. This disconnect matters because SharePoint functions as an enterprise trust hub — it vouches for sessions to Azure AD, Teams, Power Automate, and permission management systems. An XSS here executes in a context that already carries enterprise identity authority. The CVSS 5.4 rating capping impact at 'spoofing' deserves scrutiny: in a platform where 'spoofing' can chain into workflow injection, permission manipulation, and admin interface access, the stated ceiling may reflect a narrow testing scope rather than the realistic impact ceiling. The authorized user isn't necessarily an admin. Contributors manipulating document metadata, designers with page edit access, or contractors with limited tenant footprint all meet the 'authorized' threshold — yet occupy vastly different positions on the privilege spectrum the CVSS vector doesn't distinguish. From a defensive priority standpoint: treat this as a medium-severity vulnerability in a high-value target. The low EPSS should not justify deprioritization. Patch cadence matters more here than typical — each week an authorized user base expands through personnel turnover and contractor churn, and SharePoint's deprecated surfaces (SharePoint Designer workflows, legacy web parts, InfoPath forms still living in content databases) extend the actual attack surface beyond what the modern context assessment captures.

Reviewed through automated stages and approved by a human before publication.