CVE-2026-32201

Imagine SharePoint as a reception desk that shows “trusted” signs and buttons. This vulnerability lets an attacker forge those signs over the network so victims (and systems) can be tricked into accepting something they shouldn’t—without needing a login. In real attacks, the spoofing is used as a stepping stone to break into the server and do more harmful actions like installing malware.

This matters if your business runs Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition (including “SharePoint Server”) on your network. Because the weakness can be triggered remotely without authentication, it’s especially relevant when the SharePoint web endpoints are reachable from the internet or from untrusted networks. This is a risk only when the vulnerable SharePoint service is reachable and available to an attacker on the network.

This is RED because real attackers are actively exploiting CVE-2026-32201, and CISA added it to the KEV catalog with a required action date of 2026-04-28. Since exploitation has been reported in the wild, treating it as “medium risk” would be unsafe—patching to the fixed builds is the immediate priority.

Confirm exposure

1. Identify the exact SharePoint product/version/build running on each server (SharePoint Server 2016 vs 2019 vs Subscription Edition).
2. Check your current installed build against the known fixed builds:
   • SharePoint Enterprise Server 2016 → fixed in 16.0.5548.1003
   • SharePoint Server 2019 → fixed in 16.0.10417.20114
   • SharePoint Server Subscription Edition / SharePoint Server → fixed in 16.0.19725.20210

Remediate

3. Apply the Microsoft security update for CVE-2026-32201 using the official Microsoft Update Guide linked in the vendor remediation materials.
4. Restart/apply any required configuration steps after installation per Microsoft guidance for your specific SharePoint version.

If patching is delayed

5. Follow vendor mitigation instructions referenced by CISA (apply mitigations per vendor instructions).
6. Reduce exposure: block or restrict external/untrusted network access to the SharePoint web endpoints until patched (especially anything that would allow remote access to the vulnerable service).

Operational follow-up (what to monitor)

7. Look for indicators of spoofing/compromise activities in SharePoint/IIS logs and server events around the time of any suspicious access.
8. If your environment may have been exposed before patching, treat it as an incident: confirm server integrity and whether attackers performed post-exploitation activity as reported (e.g., key theft and malware deployment).

KEV deadline

9. CISA remediation due date is 2026-04-28 for KEV-listed systems.

CVE-2026-32201 is a spoofing vulnerability (CWE-20) in Microsoft SharePoint Server caused by improper input validation. The findings indicate it can be performed remotely over the network without authentication and without user interaction. CISA KEV listing (added 2026-04-14) and reporting state active exploitation in the wild; reported attacker behavior includes bypassing authentication, achieving remote code execution, and performing post-exploitation such as stealing IIS machine keys and deploying malware. No public exploit code was found on record, but exploit maturity is high enough for KEV and real-world incident reporting. EPSS is described as rising (prediction), but KEV/real exploitation is the primary driver for urgency.