NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

Microsoft SharePoint Server spoofing flaw CVE-2026-32201 used in attacks; fixes available

Attackers exploited a SharePoint Server flaw that can expose or alter sensitive information without a login. Fixes cover Server 2016, 2019 and Subscription Edition. Ask your IT provider to confirm updates are installed and check for compromise.

What to do

If your business or family office runs SharePoint Server, ask its IT provider to install current security updates, including at least KB5002861 for 2016, KB5002854 for 2019 or KB5002853 for Subscription Edition. Have them verify successful installation and investigate possible compromise, particularly if the server was exposed to the internet while unpatched.

What’s happening

CVE-2026-32201 is an input-validation flaw in organisation-hosted Microsoft SharePoint Server that allows an attacker without a login to perform spoofing over a network. Microsoft says successful exploitation can expose some sensitive information and allow changes to it, without requiring someone to click anything. It affects SharePoint Enterprise Server 2016, Server 2019 and Subscription Edition. Microsoft released fixes for all three on 14 April, when exploitation was already confirmed and CISA added the flaw to its exploited-vulnerabilities catalogue. In April, Shadowserver still counted more than 1,300 exposed, unpatched servers, according to BleepingComputer. CISA renewed its exploitation warning on 14 July alongside other SharePoint flaws, recommending current updates and checks for compromise. As of 3 November, fixes are available; the reviewed sources provide no public all-clear or identified attackers.

What
Flaw
Affects
Microsoft SharePoint Server 2016, 2019 and Subscription Edition
Affected
Microsoft SharePoint Enterprise Server 2016 before 16.0.5548.1003
Microsoft SharePoint Server 2019 before 16.0.10417.20114
Microsoft SharePoint Server Subscription Edition before 16.0.19725.20210
Fixed in
Microsoft SharePoint Enterprise Server 2016 16.0.5548.1003 (KB5002861)
Microsoft SharePoint Server 2019 16.0.10417.20114 (KB5002854)
Microsoft SharePoint Server Subscription Edition 16.0.19725.20210 (KB5002853)
CVE
CVE-2026-32201
Since
14 Apr 2026
Closed
14 July 2026

Timeline

  1. Update

    CISA renewed its warning about active exploitation of this and two other SharePoint flaws. It urged organisations to install current updates, verify installation and investigate possible compromise.

  2. Wider attacks

    BleepingComputer reported ongoing exploitation and cited Shadowserver's finding of more than 1,300 internet-exposed SharePoint servers still unpatched against this flaw.

  3. CISA added

    CISA added CVE-2026-32201 to its Known Exploited Vulnerabilities catalogue.

  4. Made publicFixed

    Microsoft disclosed CVE-2026-32201 and released security updates. It confirmed that attackers were already exploiting the SharePoint Server spoofing flaw.

Sources

  1. SharePoint Server 2016 security update: 14 April 2026 (KB5002861)Microsoft · 14 Apr 2026
  2. SharePoint Server 2019 security update: 14 April 2026 (KB5002854)Microsoft · 14 Apr 2026
  3. SharePoint Server Subscription Edition security update: 14 April 2026 (KB5002853)Microsoft · 14 Apr 2026
  4. CISA Urges SharePoint Hardening After New ExploitationsCISA · 14 July 2026
  5. Microsoft Patches Exploited SharePoint Zero-Day and 160 Other VulnerabilitiesSecurityWeek · 16 Apr 2026
  6. Over 1,300 Microsoft SharePoint servers vulnerable to spoofing attacksBleepingComputer · 22 Apr 2026
  7. CISA warns admins to patch actively exploited SharePoint flawsBleepingComputer · 15 July 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from April 2026 · JSON · RSS