The CVSS 5.4 on this SharePoint XSS masks a critical reframing: this isn't a credential-harvesting XSS exploitable by external attackers. It requires an already-authorized user with valid SharePoint credentials, shifting the threat model from session theft to insider threat, privilege escalation, or intra-organization spoofing. That distinction should fundamentally alter your triage logic — the EPSS score of 0.00283 reflects that this isn't a perimeter vulnerability, and exploitation signals confirm it.
The more important question is what 'spoofing' means in your SharePoint context. It could be profile impersonation, masquerading as other users in comments or discussions, or manipulating permission displays. Each carries different business impact. Push Microsoft for the specific authorization level required — the gap between 'any authenticated user' and 'contributor-level access' dramatically changes incident-response priorities.
But don't stop at the vulnerability itself. Consider the cascade: SharePoint rarely lives in isolation. It's the substrate for Power Automate workflows, Power Apps data connections, Teams file integrations, and Viva content. A spoofing capability within SharePoint can become a trust anchor that downstream systems — Planner, Power BI, SharePoint-hosted Power Apps — accept without re-verification because the signal originated from a legitimate, permissioned session. That's a vulnerability in your collaboration infrastructure, not a standalone app.
Finally, recognize that authorization rots. The 'authorized attacker' constraint assumes a static permission model — it isn't. SharePoint sites outlive the projects that created them, and site owners leave companies while permission inheritance often survives intact. Orphaned sites with stale contributor access represent the real attack surface eighteen months from now, when EPSS modeling no longer reflects your deployment. Your compensating control question isn't just 'patch or harden authentication' — it's whether your access review cadence matches your asset abandonment rate, and whether your SharePoint permissions auditing extends to deprecated sites that have fallen out of search results.