MEDIUM Actively exploited CWE-20
CVE-2026-32201
Microsoft SharePoint Server Spoofing Vulnerability
Microsoft·SharePoint Server
6.5/ 10
CVSS 3.1
Medium severity
44%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 99% of all CVEs
Listed
CISA KEV catalog
- Added
- Apr 14, 2026
- Fix due
- Apr 28, 2026
- Ransomware
- Not known
Timeline
- Published
- Apr 14, 2026
- Updated
- Oct 15, 2026
- First covered
- Jul 17, 2026
- Latest story
- 1 month ago
Summary
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CWE-20Improper Input Validation
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityLow
IntegrityLow
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:CCISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
- Microsoft SharePoint Enterprise Server 201616.0.0 to before 16.0.5548.1003
- Microsoft SharePoint Server 201916.0.0 to before 16.0.10417.20114
- Microsoft SharePoint Server Subscription Edition16.0.0 to before 16.0.19725.20210