SharePoint Server spoofing via improper input validation
Network-reachable spoofing flaw in on-premises Microsoft SharePoint Server (Enterprise 2016, Server 2019, Subscription Edition). Patched by Microsoft in April 2026; on CISA KEV since 2026-04-14.
- Vendor
- Microsoft
- Product
- Microsoft SharePoint Server (Enterprise 2016, Server 2019, Subscription Edition)
- CVSS
- 6.5
- EPSS (exploit probability)
- 43.4%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-32201 being exploited?
Yes. CISA added CVE-2026-32201 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 43.4% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
What to do
US federal civilian agencies must remediate by (14 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-32201 is an improper-input-validation vulnerability in on-premises Microsoft SharePoint Server that enables network-based spoofing without user interaction. Per Microsoft’s advisory and the NVD record, the fix is present in the April 2026 SharePoint security update for Enterprise Server 2016 (16.0.5548.1003), Server 2019 (16.0.10417.20114), and Subscription Edition (16.0.19725.20210). NVD scores it 6.5 (medium) with CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-04-14, and re-flagged it on 2026-07-15 alongside CVE-2026-45659 and CVE-2026-56164 as one of three actively exploited on-premises SharePoint bugs — the BOD 26-04 federal deadline is 2026-07-17. Coverage: CISA: three SharePoint bugs exploited, patch by July 17.
Other Microsoft SharePoint CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 2.1% | |
| CVE-2026-55040 SharePoint Server JWT token authentication bypasswrite-up | [ CRITICAL ] | 9.1 | 69.5% | |
| CVE-2026-50522 SharePoint Server deserialization of untrusted data RCEwrite-up | [ CRITICAL ] | 9.8 | 3.0% | |
| CVE-2026-58644 Microsoft SharePoint deserialization of untrusted data (unauth RCE)write-up | [ CRITICAL ] | 9.8 | 15.9% | |
| CVE-2026-56164 SharePoint Server elevation of privilege — missing authentication for critical functionwrite-up | [ MEDIUM ] | 5.3 | 1.0% | |
| CVE-2026-45659 Microsoft SharePoint Server deserialization remote code executionransomware usewrite-up | [ HIGH ] | 8.8 | 2.7% | |
| CVE-2026-20963 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 29.2% | |
| CVE-2025-49706 Microsoft SharePoint Improper Authentication Vulnerabilityransomware use | [ MEDIUM ] | 6.5 | 99.1% |
