# CVE-2026-32201: Microsoft SharePoint Server Zero-Day Spoofing Vulnerability via Improper Input Validation (Actively Exploited)

> Microsoft SharePoint Server contains a zero-day spoofing vulnerability (CVE-2026-32201, CVSS 6.5) caused by improper input validation (CWE-20) that manifests as cross-site scripting (XSS). Actively exploited in the wild prior to patching, the flaw allows unauthenticated attackers to inject malicious scripts into SharePoint pages over the network, enabling session hijacking, credential theft, and unauthorized data access. CISA added this to the KEV catalog on April 14, 2026, with a remediation deadline of April 28, 2026.

- **Published:** 2026-04-15T12:00:00Z
- **Last reviewed:** 2026-04-15T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0366
- **ID:** TL-2026-0366
- **Severity:** CRITICAL (CVSS 6.5)
- **Category:** ZERO_DAY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-32201

## Description

CVE-2026-32201 is a spoofing vulnerability in Microsoft SharePoint Server caused by improper input validation (CWE-20) that allows an unauthorized attacker to perform spoofing over a network. The vulnerability manifests as a cross-site scripting (XSS) flaw, consistent with historical patterns where SharePoint spoofing vulnerabilities have been XSS-based.

The attack requires no authentication, no special privileges, and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). An attacker can target internet-facing SharePoint instances directly, injecting malicious JavaScript through improperly sanitized input fields. Successful exploitation enables the attacker to view sensitive information (Confidentiality impact: Low) and make changes to disclosed information (Integrity impact: Low), with no impact on availability.

In practical attack scenarios, malicious JavaScript executing in the browser of a user visiting a compromised SharePoint page can steal session cookies or authentication tokens, enabling account takeover. The XSS foothold opens pathways for phishing redirects, credential harvesting, user impersonation, and pivoting to other internal services. Given SharePoint's role as an enterprise collaboration hub containing sensitive documents, workflows, and integrated access controls, successful exploitation provides a treasure trove of data for threat actors and a vector for lateral movement through weaponized documents.

This vulnerability follows a concerning pattern. As noted by Tenable's Satnam Narang, the last SharePoint Server spoofing vulnerability exploited as a zero-day was CVE-2025-49706 from July 2025, which was part of the ToolShell exploit chain used by ransomware and cyberespionage groups. The recurrence of actively exploited SharePoint spoofing flaws underscores the platform's attractiveness as a high-value target.

Microsoft confirmed active exploitation prior to patch availability, classifying this as a zero-day. Despite the moderate CVSS score of 6.5, the active exploitation status, zero-day nature, and SharePoint's widespread enterprise deployment surface elevate the operational severity. CISA added CVE-2026-32201 to the Known Exploited Vulnerabilities catalog on April 14, 2026, with a binding remediation deadline of April 28, 2026 under BOD 22-01.

Microsoft released security patches as part of the April 2026 Patch Tuesday (which addressed 163-171 CVEs total, including 8 critical and 2 zero-days). The second zero-day was CVE-2026-33825, a Microsoft Defender Elevation of Privilege vulnerability that was publicly disclosed but not yet actively exploited. A related SharePoint spoofing vulnerability, CVE-2026-20945 (CVSS 4.6), was also patched but is not known to be exploited.

Affected versions and their corresponding patches:
- SharePoint Server Subscription Edition: versions prior to 16.0.19725.20210 (KB5002853)
- SharePoint Server 2019: versions prior to 16.0.10417.20114 (KB5002854)
- SharePoint Enterprise Server 2016: versions prior to 16.0.5548.1003 (KB5002861)

Organizations running internet-facing SharePoint servers should treat this as the highest priority patch of the April 2026 cycle. If immediate patching is not feasible, compensating controls include restricting network access to SharePoint, tightening reverse-proxy routing and allowlists, reviewing Content Security Policy headers, and disabling unnecessary external exposure.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1189 Drive-by Compromise
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1505 Server Software Component
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1539 Steal Web Session Cookie
- T1080 Taint Shared Content
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1491 Defacement

## Sources

- [NVD - CVE-2026-32201](https://nvd.nist.gov/vuln/detail/CVE-2026-32201)
- [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/04/14/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [Microsoft Security Response Center - CVE-2026-32201](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201)
- [Tenable Analysis - April 2026 Patch Tuesday (CVE-2026-32201)](https://www.tenable.com/blog/microsofts-april-2026-patch-tuesday-addresses-163-cves-cve-2026-32201)
- [BleepingComputer - Microsoft April 2026 Patch Tuesday Fixes 167 Flaws, 2 Zero-Days](https://www.bleepingcomputer.com/news/microsoft/microsoft-april-2026-patch-tuesday-fixes-167-flaws-2-zero-days/)
- [Security Affairs - Microsoft Patch Tuesday April 2026 SharePoint Zero-Day](https://securityaffairs.com/190831/security/microsoft-patch-tuesday-for-april-2026-fixed-actively-exploited-sharepoint-zero-day.html)
- [Zero Day Initiative - April 2026 Security Update Review](https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review)
- [Arctic Wolf - Microsoft Patch Tuesday April 2026](https://arcticwolf.com/resources/blog-uk/microsoft-patch-tuesday-apr-2026/)
- [Computer Weekly - April Patch Tuesday Zero-Days in Defender and SharePoint](https://www.computerweekly.com/news/366641679/April-Patch-Tuesday-brings-zero-days-in-Defender-SharePoint-Server)
- [CSO Online - April Patch Tuesday Roundup: Zero Day Vulnerabilities](https://www.csoonline.com/article/4158706/april-patch-tuesday-roundup-zero-day-vulnerabilities-and-critical-bugs.html)
- [Lansweeper - Microsoft Patch Tuesday April 2026](https://www.lansweeper.com/blog/patch-tuesday/microsoft-patch-tuesday-april-2026/)
- [CyberSecurity News - Microsoft Patch Tuesday April 2026](https://cybersecuritynews.com/microsoft-patch-tuesday-april-2026/)
- [CIRCL Vulnerability Lookup - CVE-2026-32201](https://vulnerability.circl.lu/vuln/CVE-2026-32201)
- [CISA KEV Catalog Entry - CVE-2026-32201](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-32201)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0366