PT-2026-32853 · Microsoft · Sharepoint Server

Published 2026-04-14 · Updated 2026-07-15 · CVE-2026-32201

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Server Subscription Edition (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified)

Description Improper input validation in Microsoft SharePoint allows an unauthenticated remote attacker to perform spoofing over a network. This issue enables attackers to gain unauthorized access to sensitive information, view protected data, and tamper with or modify disclosed information without requiring a password or user interaction. Spoofing is a technique where an attacker masquerades as a trusted entity to deceive users or systems. Real-world exploitation has been documented, including an incident where hackers accessed the Homeland Security Information Network and a connected SharePoint system. It is estimated that over 1,300 servers remained unpatched and exposed to these active attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

DoS

LPE

SSRF

Weakness Enumeration

CWE-20

CWE-918

Related Identifiers

BDU:2026-05272

CVE-2026-32201

Affected Products

Sharepoint Server

References · 146

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32201 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32201 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05272 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32201 · Security Note
• https://twitter.com/ALLITAustralia/status/2048834449975169307 · Twitter Post
• https://twitter.com/lyrie_ai/status/2052991162248520176 · Twitter Post
• https://t.me/netlas/595 · Telegram Post
• https://twitter.com/sovereignexec/status/2044400462447722716 · Twitter Post
• https://twitter.com/vuln_tracker/status/2044354297245073431 · Twitter Post
• https://twitter.com/aviatrixtrc/status/2044470993956069752 · Twitter Post
• https://twitter.com/RedHornet_Intel/status/2044303202678460691 · Twitter Post
• https://twitter.com/christinayiotis/status/2047010489339686935 · Twitter Post
• https://twitter.com/swapnil_mengi/status/2044377698844467568 · Twitter Post
• https://twitter.com/CyberDevOG/status/2044343081135153462 · Twitter Post