CVE-2026-32201KEV · OVERDUECWE-20

Microsoft SharePoint Server Spoofing Vulnerability

Medium · published April 14, 2026

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 6.5. It is confirmed in active exploitation. It sits in the 98.7th percentile for exploit probability.

178
days past CISA
deadline
CVSS v3.1
6.5
EPSS
43%
Percentile
98.7
In the wild
Confirmed
What it is

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.43378 · 98.7th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-04-14T16:58Z
KEV added
2026-04-14 · due 2026-04-28
EPSS history
Timeline
  • 03 OCT 03:43Z
    EPSS moved 1% → 43%
    epss
  • 25 SEP 03:25Z
    EPSS moved 43% → 1%
    epss
  • 14 APR 16:58Z
    Microsoft SharePoint Server Spoofing Vulnerability
    cvelistv5
  • 14 APR 00:00Z
    Added to CISA KEV — remediate by Apr 28
    kev