CVE-2026-70306 is a Cross-Site Scripting vulnerability in SharePoint with a CVSS 9.3 rating but an EPSS score of only 0.00561. That gap is the most important thing to understand about this vulnerability, and it should change how you prioritize your response.
The CVSS score reflects technical severity: a successful exploit can execute arbitrary JavaScript in a victim's browser. But the low EPSS tells you exploitation is currently unlikely in the wild. This is not a contradiction — it reflects the specific conditions required to weaponize this vulnerability. Exploitation requires an authenticated SharePoint user who can be convinced to interact with malicious content, plus the trust inheritance model of SharePoint means that content authored by trusted users runs with elevated context in the browser.
Here is what should drive your prioritization: SharePoint is not a web application — it is your organization's institutional memory. When XSS pivots from a single user's session into SharePoint's object model, the attacker inherits the permission topology of that user account. Every document they could access, every site they could write to, every integration (Teams, Power Automate, external sharing) that inherits that trust becomes a potential pivot point. The EPSS measures scanning probability, not blast radius.
Defenders should prioritize detection over immediate patching. Deploy content security policy headers that restrict inline script execution across SharePoint web applications. Enable SharePoint audit logging for all content modification events and correlate these with alerts for suspicious script injection patterns. Review external user access and collaboration settings — the attack surface includes external collaborators who may have write access to shared content.
The deeper concern is not this specific CVE — it is the pattern. SharePoint has a history of XSS vulnerabilities across its extensibility surface: web parts, workflows, custom views, and now Power Apps integration. Each gets patched individually, but the underlying friction between collaboration features and security boundaries remains. Microsoft's security development lifecycle is updating too slowly relative to feature expansion. Treat this CVE as a symptom of a chronic condition: assume similar vulnerabilities exist in other extensibility paths that haven't been discovered yet. Your detection and response capability matters more than any single patch.