CVE-2026-32201: Microsoft SharePoint Server Zero-Day Spoofing Vulnerability via Improper Input Validation (Actively Exploited)

CVE-2026-32201 (TL-2026-0366), also tracked as GHSA-jmj9-qm9w-hrqj, is a critical-severity zero-day vulnerability scored CVSS 6.5, first published 2026-04-15. It has no confirmed attribution, affects Microsoft SharePoint Server Subscription Edition, references 1 CVE (CVE-2026-32201), maps to 12 MITRE ATT&CK techniques (T1027, T1036, T1059), and is covered by 9 detection rules and 14 indicators of compromise.

Key facts for TL-2026-0366

Threat ID
TL-2026-0366
Also known as
GHSA-jmj9-qm9w-hrqj, NCSC-2026-0116, MSRC_CVE-2026-32201
Severity
CRITICAL
CVSS
6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Status
ACTIVE
Category
ZERO_DAY
First published
2026-04-15
Last reviewed
2026-04-15
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
government, financial, healthcare, education, technology, defense, energy, legal, manufacturing, telecommunications
Target regions
North America, Europe, Asia-Pacific, Middle East, Global
Detection rules
9
Indicators of compromise
14

Microsoft SharePoint Server contains a zero-day spoofing vulnerability (CVE-2026-32201, CVSS 6.5) caused by improper input validation (CWE-20) that manifests as cross-site scripting (XSS). Actively exploited in the wild prior to patching, the flaw allows unauthenticated attackers to inject malicious scripts into SharePoint pages over the network, enabling session hijacking, credential theft, and unauthorized data access. CISA added this to the KEV catalog on April 14, 2026, with a remediation deadline of April 28, 2026.

How CVE-2026-32201 works

CVE-2026-32201 is a spoofing vulnerability in Microsoft SharePoint Server caused by improper input validation (CWE-20) that allows an unauthorized attacker to perform spoofing over a network. The vulnerability manifests as a cross-site scripting (XSS) flaw, consistent with historical patterns where SharePoint spoofing vulnerabilities have been XSS-based.

The attack requires no authentication, no special privileges, and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). An attacker can target internet-facing SharePoint instances directly, injecting malicious JavaScript through improperly sanitized input fields. Successful exploitation enables the attacker to view sensitive information (Confidentiality impact: Low) and make changes to disclosed information (Integrity impact: Low), with no impact on availability.

In practical attack scenarios, malicious JavaScript executing in the browser of a user visiting a compromised SharePoint page can steal session cookies or authentication tokens, enabling account takeover. The XSS foothold opens pathways for phishing redirects, credential harvesting, user impersonation, and pivoting to other internal services. Given SharePoint's role as an enterprise collaboration hub containing sensitive documents, workflows, and integrated access controls, successful exploitation provides a treasure trove of data for threat actors and a vector for lateral movement through weaponized documents.

This vulnerability follows a concerning pattern. As noted by Tenable's Satnam Narang, the last SharePoint Server spoofing vulnerability exploited as a zero-day was CVE-2025-49706 from July 2025, which was part of the ToolShell exploit chain used by ransomware and cyberespionage groups. The recurrence of actively exploited SharePoint spoofing flaws underscores the platform's attractiveness as a high-value target.

Microsoft confirmed active exploitation prior to patch availability, classifying this as a zero-day. Despite the moderate CVSS score of 6.5, the active exploitation status, zero-day nature, and SharePoint's widespread enterprise deployment surface elevate the operational severity. CISA added CVE-2026-32201 to the Known Exploited Vulnerabilities catalog on April 14, 2026, with a binding remediation deadline of April 28, 2026 under BOD 22-01.

Microsoft released security patches as part of the April 2026 Patch Tuesday (which addressed 163-171 CVEs total, including 8 critical and 2 zero-days). The second zero-day was CVE-2026-33825, a Microsoft Defender Elevation of Privilege vulnerability that was publicly disclosed but not yet actively exploited. A related SharePoint spoofing vulnerability, CVE-2026-20945 (CVSS 4.6), was also patched but is not known to be exploited.

Affected versions and their corresponding patches: - SharePoint Server Subscription Edition: versions prior to 16.0.19725.20210 (KB5002853) - SharePoint Server 2019: versions prior to 16.0.10417.20114 (KB5002854) - SharePoint Enterprise Server 2016: versions prior to 16.0.5548.1003 (KB5002861)

Organizations running internet-facing SharePoint servers should treat this as the highest priority patch of the April 2026 cycle. If immediate patching is not feasible, compensating controls include restricting network access to SharePoint, tightening reverse-proxy routing and allowlists, reviewing Content Security Policy headers, and disabling unnecessary external exposure.

MITRE ATT&CK techniques used in TL-2026-0366

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol

Lateral Movement

T1080 Taint Shared Content

Initial Access

T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories

Impact

T1491 Defacement

Persistence

T1505 Server Software Component

Credential Access

T1539 Steal Web Session Cookie

Affected products and versions in CVE-2026-32201

  • Microsoft — SharePoint Server Subscription Edition
    Vulnerable versions: 16.0.0 through 16.0.19725.20209
    Fixed in: 16.0.19725.20210 (KB5002853)
  • Microsoft — SharePoint Server 2019
    Vulnerable versions: 16.0.0 through 16.0.10417.20113
    Fixed in: 16.0.10417.20114 (KB5002854)
  • Microsoft — SharePoint Enterprise Server 2016
    Vulnerable versions: 16.0.0 through 16.0.5548.1002
    Fixed in: 16.0.5548.1003 (KB5002861)

Remediation for CVE-2026-32201

Patches

  • KB5002853 — SharePoint Server Subscription Edition (fixed version: 16.0.19725.20210)
  • KB5002854 — SharePoint Server 2019 (fixed version: 16.0.10417.20114)
  • KB5002861 — SharePoint Enterprise Server 2016 (fixed version: 16.0.5548.1003)

Immediate actions

  • Apply Microsoft security patches immediately: KB5002853 (Subscription Edition), KB5002854 (2019), KB5002861 (2016)
  • Restrict network access to SharePoint servers — limit exposure to trusted networks only
  • Tighten reverse-proxy routing and URL allowlists for SharePoint endpoints
  • Review and enforce Content Security Policy (CSP) headers on SharePoint sites
  • Monitor IIS and SharePoint ULS logs for signs of XSS exploitation attempts
  • Audit SharePoint access logs for suspicious authentication patterns from anomalous IPs

Workarounds

  • Disable external/anonymous access to SharePoint if not business-critical
  • Place SharePoint behind VPN or Zero Trust Network Access (ZTNA) to prevent unauthenticated internet access
  • Block suspicious URL patterns containing encoded script payloads at the WAF/reverse proxy layer
  • Enable HTTP-only and Secure flags on SharePoint session cookies to reduce cookie theft impact

Longer-term hardening

  • Deploy Web Application Firewall (WAF) rules to detect and block XSS payloads targeting SharePoint
  • Implement network segmentation to isolate SharePoint servers from critical internal resources
  • Enable advanced audit logging for SharePoint document access and modifications
  • Deploy EDR with behavioral detection for post-exploitation activity on SharePoint servers
  • Establish regular SharePoint security assessment cadence covering input validation and XSS testing
  • Review and minimize internet-facing SharePoint exposure — migrate to SharePoint Online where feasible

CVEs associated with CVE-2026-32201

CVE-2026-32201

Weaknesses (CWE) in CVE-2026-32201

CWE-20

Timeline of CVE-2026-32201

  • Previous SharePoint Server spoofing zero-day CVE-2025-49706 disclosed, part of the ToolShell exploit chain used by ransomware and cyberespionage groups — establishing a pattern of SharePoint spoofing exploitation
  • Multiple security vendors (Tenable, ZDI, Arctic Wolf, Immersive Labs) publish analysis identifying the spoofing flaw as XSS-based, emphasizing urgency for internet-facing SharePoint deployments
  • NVD publishes CVE-2026-32201 entry with CVSS 6.5 base score, CWE-20 classification, and affected CPE configurations for SharePoint 2016, 2019, and Subscription Edition
  • CISA adds CVE-2026-32201 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of April 28, 2026 under BOD 22-01
  • Microsoft releases security patches: KB5002853 (Subscription Edition), KB5002854 (Server 2019), KB5002861 (Enterprise Server 2016)
  • Microsoft discloses CVE-2026-32201 as part of April 2026 Patch Tuesday, confirming active exploitation in the wild prior to patch availability (zero-day)
  • NVD updates CVE-2026-32201 record; CIRCL records 19 sightings of the vulnerability with confidence level of 80%
  • CISA KEV remediation deadline — all federal civilian agencies required to have applied patches or mitigations under BOD 22-01
  • As of 2026-05-29, CVE-2026-32201 (SharePoint spoofing/XSS) is patched (KB5002853/54/61, Apr 14) but remains a live concern: it stays on CISA KEV with active in-the-wild exploitation, a public GitHub PoC now exists, and ShadowServer counted ~1,370 unpatched internet-exposed servers (Apr 22). No successor CVE supersedes it.

Sources cited for CVE-2026-32201

Threats related to CVE-2026-32201

Detection coverage for TL-2026-0366

As of 2026-04-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0366 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats