Over-1300-Microsoft-SharePoint-Servers-Vulnerable-to-Spoofing-Attacks

Post Views: 5

Microsoft SharePoint Servers Remain Vulnerable to Spoofing Attacks

More than 1,300 Microsoft SharePoint servers worldwide have not been updated to address a critical vulnerability that allows unauthorized users to conduct spoofing attacks.

Background Information

The flaw, identified as CVE-2026-32201, affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and the latest version, SharePoint Server Subscription Edition.

“The vulnerability, rated as a zero-day, enables attackers to manipulate data without requiring user interaction. This can result in sensitive information disclosure, modification of existing data, and potential disruption of service availability.”

Microsoft

Impact and Recommendations

Approximately 1,100 servers remain vulnerable: Since Microsoft released the security updates for CVE-2026-32201, fewer than 200 servers have been patched, leaving approximately 1,100 systems exposed to the risk of exploitation.
Prioritize updating your SharePoint servers: The Internet security organization Shadowserver reported this information, highlighting the urgent need for organizations to prioritize updating their SharePoint servers to prevent potential attacks.
The CISA has included CVE-2026-32201 in its Known Exploited Vulnerabilities catalog and issued a directive requiring federal civilian executive branch agencies to patch their SharePoint servers within two weeks, by April 28, as mandated by the Binding Operational Directive (BOD) 22-01.
Apply available fixes and follow vendor guidelines: Organizations should apply available fixes according to vendor guidelines, adhere to relevant BOD 22-01 recommendations for cloud services, or discontinue using the affected product if mitigation options are unavailable.