---
id: "CVE-2026-32201"
kind: "vulnerability"
aliases: ["CVE-2026-32201"]
title: "microsoft sharepoint server: Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a\u2026"
severity: "medium"
cvss: 6.5
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "microsoft sharepoint server", "fixed": ["16.0.19725.20210"], "affected": "< 16.0.19725.20210", "ecosystem": "vendor"}, {"name": "microsoft sharepoint server", "fixed": [], "affected": "= 2016", "ecosystem": "vendor"}, {"name": "microsoft sharepoint server", "fixed": [], "affected": "= 2019", "ecosystem": "vendor"}, {"name": "Microsoft SharePoint Server", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "on-premises", "other", "sharepoint-server"]
not_affected_if: ["sharepoint-online"]
published_at: "2026-04-14T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:50+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-32201", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32201", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# microsoft sharepoint server: Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a…

Microsoft SharePoint Server has an improper input validation flaw that lets an unauthorized attacker perform spoofing over the network. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:microsoft sharepoint server affected < 16.0.19725.20210 fixed 16.0.19725.20210
- vendor:microsoft sharepoint server affected = 2016 fixed ?
- vendor:microsoft sharepoint server affected = 2019 fixed ?
- vendor:Microsoft SharePoint Server affected ? fixed ?

## Fix

Apply the mitigations from Microsoft's vendor instructions, per the CISA required action; the sources do not name a patched build.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-32201
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-32201

## From the sources

Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_