{"id":"sharepoint-spoofing-attacks-apr-2026","category":"patch","status":"closed","title":"Microsoft SharePoint Server spoofing flaw CVE-2026-32201 used in attacks; fixes available","tldr":"Attackers exploited a SharePoint Server flaw that can expose or alter sensitive information without a login. Fixes cover Server 2016, 2019 and Subscription Edition. Ask your IT provider to confirm updates are installed and check for compromise.","summary":"CVE-2026-32201 is an input-validation flaw in organisation-hosted Microsoft SharePoint Server that allows an attacker without a login to perform spoofing over a network. Microsoft says successful exploitation can expose some sensitive information and allow changes to it, without requiring someone to click anything. It affects SharePoint Enterprise Server 2016, Server 2019 and Subscription Edition. Microsoft released fixes for all three on 14 April, when exploitation was already confirmed and CISA added the flaw to its exploited-vulnerabilities catalogue. In April, Shadowserver still counted more than 1,300 exposed, unpatched servers, according to BleepingComputer. CISA renewed its exploitation warning on 14 July alongside other SharePoint flaws, recommending current updates and checks for compromise. As of 3 November, fixes are available; the reviewed sources provide no public all-clear or identified attackers.","action":"If your business or family office runs SharePoint Server, ask its IT provider to install current security updates, including at least KB5002861 for 2016, KB5002854 for 2019 or KB5002853 for Subscription Edition. Have them verify successful installation and investigate possible compromise, particularly if the server was exposed to the internet while unpatched.","product":"Microsoft SharePoint Server 2016, 2019 and Subscription Edition","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-32201"],"tags":["microsoft","sharepoint","server","spoofing","zero-day","actively-exploited"],"affected":["Microsoft SharePoint Enterprise Server 2016 before 16.0.5548.1003","Microsoft SharePoint Server 2019 before 16.0.10417.20114","Microsoft SharePoint Server Subscription Edition before 16.0.19725.20210"],"fixed":["Microsoft SharePoint Enterprise Server 2016 16.0.5548.1003 (KB5002861)","Microsoft SharePoint Server 2019 16.0.10417.20114 (KB5002854)","Microsoft SharePoint Server Subscription Edition 16.0.19725.20210 (KB5002853)"],"matches":[],"sources":[{"kind":"advisory","title":"SharePoint Server 2016 security update: 14 April 2026 (KB5002861)","url":"https://support.microsoft.com/en-us/servicing/office/update/description-of-the-security-update-for-sharepoint-server-2016-april-14-2026-kb5002861","by":"Microsoft","date":"2026-04-14"},{"kind":"advisory","title":"SharePoint Server 2019 security update: 14 April 2026 (KB5002854)","url":"https://support.microsoft.com/en-au/servicing/office/update/description-of-the-security-update-for-sharepoint-server-2019-april-14-2026-kb5002854","by":"Microsoft","date":"2026-04-14"},{"kind":"advisory","title":"SharePoint Server Subscription Edition security update: 14 April 2026 (KB5002853)","url":"https://support.microsoft.com/en-au/servicing/office/update/description-of-the-security-update-for-sharepoint-server-subscription-edition-april-14-2026-kb500285","by":"Microsoft","date":"2026-04-14"},{"kind":"advisory","title":"CISA Urges SharePoint Hardening After New Exploitations","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/4208511","by":"CISA","date":"2026-07-14"},{"kind":"news","title":"Microsoft Patches Exploited SharePoint Zero-Day and 160 Other Vulnerabilities","url":"https://www.securityweek.com/microsoft-patches-exploited-sharepoint-zero-day-and-160-other-vulnerabilities/","by":"SecurityWeek","date":"2026-04-16"},{"kind":"news","title":"Over 1,300 Microsoft SharePoint servers vulnerable to spoofing attacks","url":"https://www.bleepingcomputer.com/news/security/over-1-300-microsoft-sharepoint-servers-vulnerable-to-ongoing-attacks/","by":"BleepingComputer","date":"2026-04-22"},{"kind":"news","title":"CISA warns admins to patch actively exploited SharePoint flaws","url":"https://www.bleepingcomputer.com/news/security/cisa-warns-admins-to-patch-actively-exploited-sharepoint-flaws/","by":"BleepingComputer","date":"2026-07-15"}],"started":"2026-04-14","closed":"2026-07-14","created":"2026-11-03T22:25:39.217Z","updated":"2026-11-03T22:25:39.217Z","cve_notes":[{"cve":"CVE-2026-32201","name":"Input-validation spoofing flaw in SharePoint Server","what":"Improper checking of input in Microsoft SharePoint Server lets an unauthorised network attacker perform spoofing that can expose some sensitive information and allow changes to it.","severity":"high","cvss":6.5}],"timeline":[{"at":"2026-07-14","added":"2026-11-03T22:23:31.291Z","kind":"other","text":"CISA renewed its warning about active exploitation of this and two other SharePoint flaws. It urged organisations to install current updates, verify installation and investigate possible compromise.","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/4208511","by":"CISA","patch":null},{"at":"2026-04-22","added":"2026-11-03T22:23:31.291Z","kind":"wider-attacks","text":"BleepingComputer reported ongoing exploitation and cited Shadowserver's finding of more than 1,300 internet-exposed SharePoint servers still unpatched against this flaw.","url":"https://www.bleepingcomputer.com/news/security/over-1-300-microsoft-sharepoint-servers-vulnerable-to-ongoing-attacks/","by":"BleepingComputer","patch":null},{"at":"2026-04-14","added":"2026-11-03T22:23:31.291Z","kind":"cisa-added","text":"CISA added CVE-2026-32201 to its Known Exploited Vulnerabilities catalogue.","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/4208511","by":"CISA","patch":null},{"at":"2026-04-14","added":"2026-11-03T22:23:31.291Z","kind":"disclosed","text":"Microsoft disclosed CVE-2026-32201 and released security updates. It confirmed that attackers were already exploiting the SharePoint Server spoofing flaw.","url":"https://www.securityweek.com/microsoft-patches-exploited-sharepoint-zero-day-and-160-other-vulnerabilities/","by":"SecurityWeek","patch":"patched"}],"url":"https://hard.fyi/live/sharepoint-spoofing-attacks-apr-2026/","json":"https://hard.fyi/api/live?id=sharepoint-spoofing-attacks-apr-2026"}