CVE-2026-32201
Microsoft SharePoint Server Improper Input Validation Vulnerability
Description
CVE-2026-32201 is a MEDIUM-severity improper input validation vulnerability in Microsoft Office SharePoint Server, carrying a CVSS 3.1 score of 6.5. According to Microsoft, the flaw allows an unauthorized attacker to perform spoofing over a network, meaning crafted input can cause SharePoint to misrepresent the source or integrity of content shown to users. The vulnerability affects SharePoint Server 2016, 2019, and builds below 16.0.19725.20210, and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2026-04-28. With an EPSS score of 0.00596 (69.4th percentile) and no known ransomware association, CVE-2026-32201 still warrants prompt remediation because exploitation requires no authentication and no user interaction, making it attractive for phishing-adjacent spoofing campaigns against enterprise SharePoint deployments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | sharepoint server | < 16.0.19725.20210; 2016; 2019 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-32201(Third Party Advisory, US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
CVE-2026-32201 is classified under CWE-20 — Improper Input Validation. This weakness occurs when a product receives input but does not validate, or incorrectly validates, that the input has the properties required to process it safely. In Microsoft SharePoint Server, insufficient validation of network-supplied data allows an attacker to craft input that the server accepts and renders in a way that spoofs legitimate content or identities. Because input validation sits on the trust boundary between untrusted callers and the application logic, a defect here can bypass downstream security controls even when the rest of the application is otherwise hardened.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2026-32201 carries a CVSS 3.1 score of 6.5 (MEDIUM) with an unchanged scope, meaning the impact is contained within the affected SharePoint Server component. Attack Vector (Network): the vulnerability is remotely exploitable against any SharePoint instance reachable by the attacker, without physical or adjacent-network access. Attack Complexity (Low) combined with Privileges Required (None) and User Interaction (None) means exploitation is straightforward and fully unauthenticated — no special conditions and no victim action are required. Confidentiality (Low) and Integrity (Low): an attacker can obtain or alter a limited amount of information, which in a spoofing context typically translates to forging the appearance, sender, or trust signals of SharePoint content that downstream users rely on. Availability (None): the vulnerability does not cause denial of service on its own. With an EPSS score of 0.00596 (69.4th percentile), exploitation probability is modest in absolute terms but above average across the CVE population, and the KEV listing confirms that CISA has observed real-world abuse.
Exploit Maturity
CVE-2026-32201 has confirmed active exploitation in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-04-14 with a federal remediation deadline of 2026-04-28, which is a strong signal that working exploitation techniques are already in use against production SharePoint environments. Public exploits: the NVD references list only a Microsoft vendor advisory and a CISA KEV entry, so no public proof-of-concept code is indexed at this time, but absence of a published PoC is not absence of exploitation. Exploitation probability: the EPSS score of 0.00596 places the vulnerability in the 69.4th percentile, indicating above-average but not runaway exploitation likelihood — however, this score reflects observed probing and can rise quickly after KEV inclusion. Ransomware association: no ransomware use has been reported, yet spoofing flaws in collaboration platforms are commonly chained with phishing and credential harvesting, so defenders should assume that CVE-2026-32201 may feed into broader intrusion chains.
Remediation
- Apply Microsoft's SharePoint security update immediately. Per the KEV required action, apply mitigations per vendor instructions; consult the Microsoft Security Response Center advisory for CVE-2026-32201 at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201 and install the patch that brings SharePoint Server builds to 16.0.19725.20210 or later.
- Inventory all SharePoint Server 2016 and 2019 deployments. Use your asset management and vulnerability scanning tooling to enumerate every SharePoint farm, front-end server, and hybrid deployment, including development and disaster-recovery instances, and confirm each has been patched.
- Restrict network exposure of SharePoint as an interim mitigation. Place SharePoint behind VPN, Zero Trust Network Access, or IP allow-listing for remote users, and ensure web application firewall rules in front of SharePoint inspect and reject malformed requests until patching is complete.
- Harden server-side input validation at the gateway. Apply strict allowlist-based validation of request parameters, headers, and uploaded content at the reverse proxy or WAF layer, reflecting the CWE-20 guidance to never rely solely on client-side validation.
- Review SharePoint and IIS logs for spoofing indicators. Hunt for unusual POST bodies, unexpected Host or Referer headers, anomalous content types, and user reports of suspicious SharePoint pages or notifications that could indicate exploitation attempts against CVE-2026-32201.
- Update detection content and user awareness. Push updated signatures to EDR, SIEM, and email security tooling, and remind users that SharePoint content — like email — can be spoofed, so they should verify high-trust actions out of band.
Technical Details
CVE-2026-32201 stems from improper input validation in Microsoft Office SharePoint Server, where request data processed over the network is not strictly verified against expected formats, types, or ranges before being used in response generation. Mechanism: an attacker sends specifically crafted input to a reachable SharePoint endpoint, and because the server fails to enforce the properties required to process the data safely, the resulting response can spoof legitimate content — for example by manipulating identifiers, references, or rendered metadata that users and integrated systems rely upon. CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N): the network attack vector, low complexity, no privileges, and no user interaction make exploitation trivially reachable once a vulnerable SharePoint instance is exposed; the low confidentiality and integrity impact and absence of availability impact reflect that the outcome is spoofing of content rather than full compromise. CWE mapping: CWE-20 captures the root cause — the trust boundary between the HTTP client and the SharePoint application does not enforce sufficient validation, which is also the same class of weakness that historically underpins many SharePoint deserialization and request-smuggling issues.
Frequently Asked Questions
Is CVE-2026-32201 being actively exploited?
Yes. CISA added CVE-2026-32201 to its Known Exploited Vulnerabilities catalog on 2026-04-14, confirming real-world exploitation of this Microsoft SharePoint Server spoofing vulnerability, with a federal remediation deadline of 2026-04-28. No ransomware group has been publicly linked to it yet, but the EPSS score of 0.00596 (69.4th percentile) and unauthenticated network attack profile make it an attractive target.
What products are affected by CVE-2026-32201?
Microsoft SharePoint Server 2016, SharePoint Server 2019, and all SharePoint Server builds below 16.0.19725.20210 are affected. Organizations running on-premises or hybrid SharePoint deployments should verify their build numbers against Microsoft's security advisory for CVE-2026-32201. SharePoint Online tenants should follow applicable BOD 22-01 cloud guidance as referenced in the KEV entry.
How do I fix CVE-2026-32201?
Apply Microsoft's security update so SharePoint Server is at build 16.0.19725.20210 or later, following the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201. Until patching is complete, limit SharePoint's network exposure via VPN or Zero Trust access, tighten WAF input validation rules, and review SharePoint and IIS logs for spoofing indicators.
How severe is CVE-2026-32201?
CVE-2026-32201 is rated MEDIUM with a CVSS 3.1 score of 6.5 and an EPSS score of 0.00596 (69.4th percentile). While the technical impact — low confidentiality and integrity loss through spoofing — is more limited than a remote code execution bug, the combination of network attack vector, no authentication, no user interaction, and KEV-confirmed exploitation justifies prioritized remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.