Microsoft SharePoint known exploited vulnerabilities
We track 15 CVEs in Microsoft SharePoint. All of them are on CISA's Known Exploited Vulnerabilities catalog, meaning CISA has evidence of exploitation in the wild (listed 2021–2026). CISA flags 8 of them as used in ransomware campaigns. The most recent is CVE-2026-65660, added to KEV on .
Also listed as: SharePoint Server · SharePoint Server 2016 / 2019 / Subscription Edition. CISA, NVD and vendor advisories name the same product differently; each CVE page keeps the wording from its source.
- CVEs tracked
- 15
- On CISA KEV
- 15
- Ransomware use
- 8
- Rated critical
- 7
Every Microsoft SharePoint CVE we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV | Patch by |
|---|---|---|---|---|---|
| CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 2.1% | ||
| CVE-2026-55040 SharePoint Server JWT token authentication bypasswrite-up | [ CRITICAL ] | 9.1 | 69.5% | ||
| CVE-2026-50522 SharePoint Server deserialization of untrusted data RCEwrite-up | [ CRITICAL ] | 9.8 | 3.0% | ||
| CVE-2026-58644 Microsoft SharePoint deserialization of untrusted data (unauth RCE)write-up | [ CRITICAL ] | 9.8 | 15.9% | ||
| CVE-2026-56164 SharePoint Server elevation of privilege — missing authentication for critical functionwrite-up | [ MEDIUM ] | 5.3 | 1.0% | ||
| CVE-2026-45659 Microsoft SharePoint Server deserialization remote code executionransomware usewrite-up | [ HIGH ] | 8.8 | 2.7% | ||
| CVE-2026-32201 SharePoint Server spoofing via improper input validationwrite-up | [ MEDIUM ] | 6.5 | 43.4% | ||
| CVE-2026-20963 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 29.2% | ||
| CVE-2025-49706 Microsoft SharePoint Improper Authentication Vulnerabilityransomware use | [ MEDIUM ] | 6.5 | 99.1% | ||
| CVE-2025-49704 Microsoft SharePoint Code Injection Vulnerabilityransomware use | [ HIGH ] | 8.8 | 100.0% | ||
| CVE-2025-53770 Microsoft SharePoint Deserialization of Untrusted Data Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 100.0% | ||
| CVE-2024-38094 Microsoft SharePoint Deserialization Vulnerabilityransomware use | [ HIGH ] | 7.2 | 50.9% | ||
| CVE-2023-24955 Microsoft SharePoint Server Code Injection Vulnerabilityransomware use | [ HIGH ] | 7.2 | 85.0% | ||
| CVE-2023-29357 Microsoft SharePoint Server Privilege Escalation Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 100.0% | ||
| CVE-2019-0604 Microsoft SharePoint Remote Code Execution Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 99.9% |
Sorted by date added to KEV. Severity and CVSS as stated by NVD or the vendor; EPSS from FIRST.org. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else. Machine-readable: /api/v1/vendors/microsoft.json.
Our Microsoft SharePoint coverage
- SharePoint Code Injection CVE-2026-65660 Added to KEV
- SharePoint CVE-2026-55040 Exploited After PoC Drop
- SharePoint CVE-2026-45659 Ransomware Attacks Confirmed
- N-Day Is Now N-Hour: The Vanishing Patch Window
- SharePoint RCE on KEV; Attackers Pivot to Machine Keys
- SharePoint attackers stealing keys — rotate credentials now
- SharePoint CVE-2026-50522 exploited after public PoC
- CISA adds a fourth SharePoint bug to KEV in 48 hours
- KB5099539 lands: Windows 10 ESU carries the July zero-days
- CISA: three SharePoint bugs exploited, patch by July 17
Other Microsoft products
Every row links to its CVE record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker or compare KEV catalogs.