CVE-2026-32201: Microsoft SharePoint Server improper input validation enables spoofing

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityCISA KEV listing with a near-term due date and a high EPSS percentile indicate active exploitation, even though the CVSS score is only medium.

What it is

Microsoft SharePoint Server fails to properly validate input, allowing an unauthorized attacker to perform spoofing over the network. The flaw is remotely reachable without authentication or user interaction, and CISA has added it to the Known Exploited Vulnerabilities catalog, so it warrants prompt attention despite a medium CVSS score.

Impact

An attacker can spoof content or identity within SharePoint, which can be used to mislead users or facilitate follow-on social engineering. The CVSS vector shows only low confidentiality and integrity impact, with no availability impact.

Attack surface

Reachable over the network via AV:N with no privileges (PR:N) and no user interaction (UI:N), so any network-reachable SharePoint instance is exposed. The description does not specify the exact endpoint or input field involved.

Exploitation

CISA added this to the KEV catalog on 2026-04-14 with a remediation due date of 2026-04-28, indicating known exploitation in the wild. EPSS is 0.43378 (98.7th percentile), consistent with active exploitation, though no ransomware use is documented.

What to do

• Apply the Microsoft vendor update for CVE-2026-32201 as soon as possible, per the MSRC advisory.
• If patching cannot be completed by the 2026-04-28 KEV due date, apply vendor-provided mitigations or restrict network exposure of SharePoint.
• Follow BOD 22-01 guidance for any cloud-hosted SharePoint services.
• Review and limit external network access to SharePoint endpoints to reduce the attack surface.
• Monitor for indicators of spoofing activity and validate content authenticity in SharePoint sites.

Detection

• Review SharePoint and reverse-proxy logs for anomalous requests to input-handling endpoints around the disclosure date.
• Look for unexpected content or identity changes in SharePoint sites that could indicate spoofing.
• Correlate network traffic to SharePoint servers with known exploitation indicators if vendor or CISA guidance provides them.
• Alert on authentication-free requests to SharePoint endpoints that deviate from normal patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.