Microsoft SharePoint Enterprise Server 2016 vulnerabilities

3 CVEs affecting Microsoft SharePoint Enterprise Server 2016, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-8480, published 2018-10-10.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-8378, published 2018-08-15. Medium severity, CVSS 5.5. EPSS: 6.8% chance of exploitation in the next 30 days. An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose the contents of memory, aka "Microsoft…
• CVE-2018-8480, published 2018-10-10. Medium severity, CVSS 5.4. EPSS: 2.3% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint…
• CVE-2018-8426, published 2018-09-13. Medium severity, CVSS 5.4. EPSS: 2.3% chance of exploitation in the next 30 days. A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office…