PT-2026-32853 · Microsoft · Sharepoint Server

Published 2026-04-14 · Updated 2026-05-09 · CVE-2026-32201

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Server Subscription Edition (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified)

Description Improper input validation in Microsoft SharePoint allows an unauthenticated remote attacker to perform spoofing over a network. This issue enables attackers to read and tamper with sensitive information, such as internal documents, records, and personal HR data, without requiring a password or user interaction. Exploitation can allow attackers to manipulate what users see, facilitating phishing, data manipulation, and social engineering at scale. Over 1,300 servers have been identified as remaining unpatched while the flaw is being actively exploited in real-world incidents.

Recommendations Apply the security updates released on April 14.

Fix

LPE

RCE

SSRF

Weakness Enumeration

CWE-20

CWE-918

Related Identifiers

BDU:2026-05272

CVE-2026-32201

Affected Products

Sharepoint Server

References · 128

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05272 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32201 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32201 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32201 · Security Note
• https://twitter.com/CISACyber/status/2044118019165540827 · Twitter Post
• https://twitter.com/DLTA_Sec/status/2044671935401857145 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://twitter.com/ZettaWire/status/2044118342936518990 · Twitter Post
• https://twitter.com/Teamrootio/status/2047281584840093840 · Twitter Post
• https://twitter.com/UndercodeUpdate/status/2044246628941381916 · Twitter Post
• https://twitter.com/CyberDevOG/status/2044343081135153462 · Twitter Post
• https://twitter.com/NetSecIO/status/2044408406841160169 · Twitter Post
• https://twitter.com/theSEalpha/status/2044763185895387257 · Twitter Post
• https://twitter.com/zeroday0026/status/2044379523542880505 · Twitter Post