MSRXMicrosoft SharePoint vulnerabilities
8 Microsoft SharePoint flaws were confirmed exploited in the wild in the past 365 days, 1 used in ransomware. Patch these first.
| Added | Exploited vulnerability | Fix by |
|---|---|---|
| 2026-09-25 | CVE-2026-65660 Microsoft SharePoint Microsoft SharePoint Code Injection Vulnerability Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. | 2026-09-28 |
| 2026-08-18 | CVE-2026-55040 Microsoft SharePoint Microsoft SharePoint Weak Authentication Vulnerability Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network. | 2026-08-21 |
| 2026-07-22 | CVE-2026-50522 Microsoft SharePoint Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network. | 2026-07-25 |
| 2026-07-16 | CVE-2026-58644 Microsoft SharePoint Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. | 2026-07-19 |
| 2026-07-14 | CVE-2026-56164 Microsoft SharePoint Server Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network. | 2026-07-17 |
| 2026-07-01 | CVE-2026-45659 Microsoft SharePoint Server ransomwareMicrosoft SharePoint Server Deserialization of Untrusted Data Vulnerability Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network. | 2026-07-04 |
| 2026-04-14 | CVE-2026-32201 Microsoft SharePoint Server Microsoft SharePoint Server Improper Input Validation Vulnerability Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network. | 2026-04-28 |
| 2026-03-18 | CVE-2026-20963 Microsoft SharePoint Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. | 2026-03-21 |
Newest Microsoft SharePoint CVEs
15 of 628 in NVD| 2026-10-28 | CVE-2026-118641 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindable parameters without escaping. Attackers who supply untrust | 6.9 |
| 2026-10-15 | CVE-2026-108452 Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 8.8 |
| 2026-10-14 | CVE-2026-88164 Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 8.8 |
| 2026-10-13 | CVE-2026-97783 Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | 8.1 |
| 2026-10-13 | CVE-2026-97782 Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network. | 6.8 |
| 2026-10-13 | CVE-2026-96044 No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 8.8 |
| 2026-10-13 | CVE-2026-88209 Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 4.6 |
| 2026-10-13 | CVE-2026-88208 Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 4.6 |
| 2026-10-13 | CVE-2026-88206 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 7.5 |
| 2026-10-13 | CVE-2026-88204 Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 7.3 |
| 2026-10-13 | CVE-2026-88200 Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 8.8 |
| 2026-10-13 | CVE-2026-88198 Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 8.8 |
| 2026-10-13 | CVE-2026-88166 Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 8.8 |
| 2026-10-13 | CVE-2026-88163 Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 8.8 |
| 2026-10-13 | CVE-2026-88155 Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 8.8 |
Keyword search in the US National Vulnerability Database, so it can include products that merely mention Microsoft SharePoint.
Source: CISA Known Exploited Vulnerabilities catalog 2026.10.28 (live), refreshed every 12 hours.