Microsoft SharePoint Server vulnerabilities
630 CVEs affecting Microsoft SharePoint Server, 20 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-97783, published 2026-10-13.
More from Microsoft.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2025-53770: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability, published 2025-07-20. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2025-07-20. EPSS: 100% chance of exploitation in the next 30 days. Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770…
- CVE-2025-49704: Microsoft SharePoint Code Injection Vulnerability, published 2025-07-08. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-07-22. EPSS: 100% chance of exploitation in the next 30 days. Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2023-29357: Microsoft SharePoint Server Privilege Escalation Vulnerability, published 2023-06-14. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2024-01-10. EPSS: 100% chance of exploitation in the next 30 days. Microsoft SharePoint Server Elevation of Privilege Vulnerability
- CVE-2019-0604: Microsoft SharePoint Remote Code Execution Vulnerability, published 2019-03-05. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 99.9% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution…
- CVE-2025-49706: Microsoft SharePoint Improper Authentication Vulnerability, published 2025-07-08. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2025-07-22. EPSS: 99.1% chance of exploitation in the next 30 days. Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- CVE-2015-1641: Microsoft Office Memory Corruption Vulnerability, published 2015-04-14. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 97.2% chance of exploitation in the next 30 days. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and…
- CVE-2020-1147: Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability, published 2020-07-14. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 94% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework,…
- CVE-2023-24955: Microsoft SharePoint Server Code Injection Vulnerability, published 2023-05-09. High severity, CVSS 7.2. Actively exploited: in CISA KEV since 2024-03-26. EPSS: 85% chance of exploitation in the next 30 days. Microsoft SharePoint Server Remote Code Execution Vulnerability
- CVE-2017-11826: Microsoft Office Remote Code Execution Vulnerability, published 2017-10-13. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 81.3% chance of exploitation in the next 30 days. Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation…
- CVE-2014-1761: Microsoft Word Memory Corruption Vulnerability, published 2014-03-25. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-02-15. EPSS: 77.7% chance of exploitation in the next 30 days. Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2…
Latest
- CVE-2026-97783, published 2026-10-13. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-97782, published 2026-10-13. Medium severity, CVSS 6.8. EPSS: 0.5% chance of exploitation in the next 30 days. Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.
- CVE-2026-97755, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
- CVE-2026-96044, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- CVE-2026-88209, published 2026-10-13. Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- CVE-2026-88208, published 2026-10-13. Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- CVE-2026-88206, published 2026-10-13. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- CVE-2026-88204, published 2026-10-13. High severity, CVSS 7.3. EPSS: 0.6% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- CVE-2026-88200, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- CVE-2026-88198, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.