CVE-2026-32201: Microsoft SharePoint Server Spoofing Vulnerability

Overview

Severity

Medium (CVSS 6.5)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C

Category

Spoofing

Exploit Status

Actively Exploited

Exploitation Likelihood

Detected

Patch Tuesday

2026-Apr

Released

2026-04-14

Last Updated

2026-04-14

EPSS Score

21.48% (percentile: 97.4%)

CISA KEV

Listed — due 2026-04-28

Description

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

FAQ

According to the CVSS metrics, successful exploitation of this vulnerability could lead to some loss of confidentiality (C:L), and integrity (I:L) but lead to no loss of availability (A:N). What is the impact of this vulnerability? An attacker who successfully exploited the vulnerability could view some sensitive information (Confidentiality), make changes to disclosed information (Integrity), but cannot limit access to the resource (Availability).

Known Exploits (1)

• Microsoft SharePoint Server Improper Input Validation Vulnerability — added 2026-04-22T21:29:40Z

Affected Products (3)

Microsoft Office

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server Subscription Edition

Security Updates (3)

• 5002861
• 5002854
• 5002853

Acknowledgments

Microsoft

Revision History

• 2026-04-14: Information published.
• 2026-04-14: Added an acknowledgement. This is an informational change only.