CVE-2026-32201
MEDIUM 6.5 KNOWN EXPLOITED PoC CATALOGUED ALL-YEARSImproper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Confirmed exploited in the wild — in CISA KEV since 2026-04-14. Patch or mitigate now.
Exploitation likelihood
43.4%chance of exploitation in 30 days · 99th percentile
Impact if exploited
6.5CVSS 3.1 · MEDIUM · CNA
- ConfidentialityLow
- IntegrityLow
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
Public PoC or exploit resources are catalogued below.
Listed by the named source; Vulnpedia has not tested these resources.
PoC data: JSON
Resource commands
curl -s https://vulnpedia.com/cve/CVE-2026-32201/poc.jsonMachine-readable PoC index for this CVE (for automation).Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Affected
Vendors Microsoft
Products Microsoft Sharepoint Enterprise Server 2016 Microsoft Sharepoint Server 2019 Microsoft Sharepoint Server Subscription Edition Sharepoint Server
Weakness (CWE)
- CWE-20: : Improper Input Validation
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C
References and research data (JSON)
Unverified PoC candidates
Catalogue matches for further research. These repositories have not been validated as working exploits.
1 candidate
- https://github.com/B1tBit/CVE-2026-32201-exploit
A spoofing vulnerability exists in Microsoft SharePoint Server due to improper input validation. An unauthenticated attacker can send a specially crafted HTTP request to inject malicious JavaScript (reflected XSS), which executes in the security context of the SharePoint site.
PoC-in-GitHub · CVE-2026-32201
PoC-in-GitHub · CVE-2026-32201 · Updated 2026-07-24T01:37:51Z
Additional exploitation reports
Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.
- VulnCheck KEV · 2026-04-12T00:00:00Z
Source guidance: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Source ransomware assessment: Unknown
VulnCheck KEV · CVE-2026-32201 · Updated 2026-04-12T00:00:00Z - VulnCheck KEV · 2026-04-12T00:00:00ZVulnCheck KEV · CVE-2026-32201
- VulnCheck KEV · 2026-04-14T00:00:00ZVulnCheck KEV · CVE-2026-32201
VulnCheck KEV · CVE-2026-32201
VulnCheck KEV · CVE-2026-32201
VulnCheck KEV · CVE-2026-32201 - VulnCheck KEV · 2026-07-14T00:00:00ZVulnCheck KEV · CVE-2026-32201
- VulnCheck KEV · 2026-07-16T00:00:00ZVulnCheck KEV · CVE-2026-32201
- VulnCheck KEV · 2026-07-18T00:00:00ZVulnCheck KEV · CVE-2026-32201
- VulnCheck KEV · 2026-08-20T00:00:00ZVulnCheck KEV · CVE-2026-32201
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Microsoft | Sharepoint Server | < 16.0.19725.20210 |
| Microsoft | Sharepoint Server | 2016 |
| Microsoft | Sharepoint Server | 2019 |
All CVSS metrics
- MEDIUM 6.5 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C - MEDIUM 6.5 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
Patches & mitigations
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201 CVE record · microsoft · Updated 2026-10-15T15:53:37.451Z
NVD · CVE-2026-32201 · Updated 2026-06-17T10:35:20.103
VulnCheck KEV · CVE-2026-32201 · Updated 2026-04-12T00:00:00Z
Advisories
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-32201 CVE record · CISA-ADP · Updated 2026-04-16T03:55:16.734Z
NVD · CVE-2026-32201 · Updated 2026-06-17T10:35:20.103 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-22587 EUVD · EUVD-2026-22587
- https://vulncheck.com/kev VulnCheck KEV · CVE-2026-32201 · Updated 2026-04-12T00:00:00Z
Technical & other
- https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit VulnCheck KEV · CVE-2026-32201 · Updated 2026-04-12T00:00:00Z
- https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Apr VulnCheck KEV · CVE-2026-32201 · Updated 2026-04-12T00:00:00Z
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-32201 VulnCheck KEV · CVE-2026-32201 · Updated 2026-04-12T00:00:00Z
- https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json VulnCheck KEV · CVE-2026-32201 · Updated 2026-04-12T00:00:00Z
- https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations VulnCheck KEV · CVE-2026-32201 · Updated 2026-04-12T00:00:00Z
- https://www.tenable.com/blog/cve-2026-32201-cve-2026-45659-cve-2026-56164-faq-sharepoint-server-exploitation VulnCheck KEV · CVE-2026-32201 · Updated 2026-04-12T00:00:00Z
- https://www.resecurity.com/es/blog/article/from-web-request-to-domain-compromise-understanding-the-july-2026-sharepoint-attacks VulnCheck KEV · CVE-2026-32201 · Updated 2026-04-12T00:00:00Z
- https://www.acn.gov.it/portale/documents/20119/1300791/Operational_Summary_lug26_CLEAR.pdf/88b05799-3e4c-f3ed-4a42-d9e68e080604?t=1787220905144 VulnCheck KEV · CVE-2026-32201 · Updated 2026-04-12T00:00:00Z
- https://vulncheck.com/xdb/958d41eb01f3 VulnCheck KEV · 958d41eb01f3 · Updated 2026-04-12T00:00:00Z
- https://github.com/B1tBit/CVE-2026-32201-exploit VulnCheck KEV · 958d41eb01f3 · Updated 2026-04-12T00:00:00Z
Sources: NVD · CVE.org · All sources and attribution · EPSS