The CVSS 5.4 rating for this SharePoint XSS should not comfort you. While the vulnerability technically requires an 'authorized attacker,' that qualifier is dangerously misleading in SharePoint's collaboration context — and the rating methodology doesn't account for why.
When a user navigates within their SharePoint environment, their browser treats that zone as fully trusted. Scripts execute, links are followed, and form data submits under the assumption that the content originates from within the organization. An XSS payload in this context doesn't merely steal a session cookie — it operates inside the victim's trust boundary. For an authenticated user who already has SharePoint access (which in large enterprises means thousands of employees), this flaw provides a pivot point into the full Microsoft 365 integration graph: Power Automate workflows, Teams content, and OAuth tokens flowing across connected services. The 'spoofing' impact in the advisory undersells what is essentially privilege escalation through the trust chain.
Your immediate priorities: First, inventory which SharePoint features and customizations your organization has deployed — including legacy web parts, deprecated form engines, and discontinued integration endpoints. These abandoned code paths often persist for backward compatibility but receive no active security review, meaning the same sanitization flaw may exist in forgotten attack surface that bypasses normal patching cadences. Second, audit your Microsoft 365 integration permissions: determine which connected services can be triggered from SharePoint events and whether the OAuth scopes assigned to SharePoint-adjacent applications are necessary. The blast radius of this vulnerability is defined by that integration graph, not by SharePoint alone. Third, treat this as a change management priority regardless of the medium-severity rating — the 'authorized attacker' qualifier expires the moment the CVE is public, expanding your threat model to include every researcher and adversary who has read the advisory. In regulated industries where SharePoint patching averages six to eight weeks, that temporal gap is where active exploitation occurs. The rating reflects vulnerability severity in isolation; your remediation should reflect the system's actual position in your identity and integration architecture.