EUVD-2026-22587Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
9DescriptionCVE.org
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Articles & Coverage 1
AnalysisAI
Improper input validation in Microsoft SharePoint Server enables network-based spoofing attacks without authentication, allowing attackers to forge communications and deceive users. Affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. This vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code, making it a critical operational priority despite the moderate CVSS score of 6.5.
Technical ContextAI
The vulnerability stems from CWE-20 (Improper Input Validation) in SharePoint's request handling mechanisms. SharePoint Server processes network-based input without sufficient validation of message authenticity or origin verification, allowing attackers to craft malicious requests that bypass identity verification controls. The network-accessible attack vector means the vulnerability is reachable from unauthenticated network positions. The affected CPE strings-microsoft_sharepoint_enterprise_server_2016, microsoft_sharepoint_server_2019, and microsoft_sharepoint_server_subscription_edition-indicate the vulnerability spans both legacy and modern deployment models, suggesting a systemic validation weakness across SharePoint's core request processing pipeline.
RemediationAI
Apply vendor-released patches immediately: upgrade SharePoint Enterprise Server 2016 to 16.0.5548.1003 or later, SharePoint Server 2019 to 16.0.10417.20114 or later, or SharePoint Server Subscription Edition to 16.0.19725.20210 or later. Given active exploitation status, patching should be prioritized within the next 24-48 hours for externally accessible SharePoint deployments. Monitor SharePoint request logs for anomalous authentication-bypass attempts or spoofed message patterns during and after patching. Consult the official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201 for environment-specific deployment guidance and any interim mitigations if immediate patching is not feasible.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today