CVE-20XX-?

Microsoft Sharepoint Server CVEs.

Published CVEs affecting Microsoft Sharepoint Server, ranked by exploit odds.

159 CVEs · updated 2026-11-06 06:52 UTC

  1. CVE-2025-53770

    Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

    Drop everything exploited Code execution Server Microsoft Sharepoint Server

    9.8 CRITICAL 100% exploit odds Fix listed
  2. CVE-2025-49704

    Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    exploited Injection Web app Microsoft Sharepoint Server

    8.8 HIGH 100% exploit odds Fix listed
  3. CVE-2025-53771

    Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

    Auth & access Server Microsoft Sharepoint Server

    6.5 MEDIUM 100% exploit odds Fix listed
  4. CVE-2026-45659

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    exploited Code execution Web app Microsoft Sharepoint Server

    8.8 HIGH 80% exploit odds Fix listed
  5. CVE-2026-55040

    Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

    Drop everything exploited Auth & access Server Microsoft Sharepoint Server

    9.1 CRITICAL 70% exploit odds Fix listed
  6. CVE-2026-32201

    Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

    exploited Other Web app Microsoft Sharepoint Server

    6.5 MEDIUM 43% exploit odds Fix listed
  7. CVE-2025-21400

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    Microsoft Sharepoint Server

    8.0 HIGH 34% exploit odds Fix listed
  8. CVE-2026-45484

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

    Code execution Server Microsoft Sharepoint Server

    8.8 HIGH 34% exploit odds Fix listed
  9. CVE-2026-33112

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Code execution Server Microsoft Sharepoint Server

    8.8 HIGH 31% exploit odds Fix listed
  10. CVE-2026-20963

    Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

    Drop everything exploited Code execution Web app Microsoft Sharepoint Server

    9.8 CRITICAL 29% exploit odds Fix listed
  11. CVE-2025-54897

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Code execution Server Microsoft Sharepoint Server

    8.8 HIGH 22% exploit odds Fix listed
  12. CVE-2025-49712

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Code execution Server Microsoft Sharepoint Server

    8.8 HIGH 21% exploit odds Fix listed
  13. CVE-2025-53760

    Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

    Disclosure Server Microsoft Sharepoint Server

    7.1 HIGH 21% exploit odds Fix listed
  14. CVE-2026-20945

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

    XSS Web app Microsoft Sharepoint Server

    4.6 MEDIUM 19% exploit odds Fix listed
  15. CVE-2026-20947

    Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Injection Server Microsoft Sharepoint Server

    8.8 HIGH 18% exploit odds Fix listed
  16. CVE-2026-58644

    Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

    Drop everything exploited Code execution Web app Microsoft Sharepoint Server

    9.8 CRITICAL 16% exploit odds Fix listed
  17. CVE-2026-65660

    Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    exploited Injection Web app Microsoft Sharepoint Server

    8.8 HIGH 8% exploit odds Fix listed
  18. CVE-2026-20959

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

    XSS Web app Microsoft Sharepoint Server

    4.6 MEDIUM 8% exploit odds Fix listed
  19. CVE-2026-26114

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Code execution Server Microsoft Sharepoint Server

    8.8 HIGH 3% exploit odds Fix listed
  20. CVE-2026-50522

    Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

    exploited Code execution Web app Microsoft Sharepoint Server

    9.8 CRITICAL 3% exploit odds Fix listed
  21. CVE-2025-30382

    Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.

    Code execution Server Microsoft Sharepoint Server

    7.8 HIGH 3% exploit odds Fix listed
  22. CVE-2025-59237

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Code execution Server Microsoft Sharepoint Server

    8.8 HIGH 3% exploit odds Fix listed
  23. CVE-2025-62204

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Code execution Web app Microsoft Sharepoint Server

    8.0 HIGH 2% exploit odds Fix listed
  24. CVE-2026-63514

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Code execution Server Microsoft Sharepoint Server

    8.8 HIGH 2% exploit odds Fix listed
  25. CVE-2026-64901

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Code execution Server Microsoft Sharepoint Server

    8.8 HIGH 2% exploit odds Fix listed
  26. CVE-2026-65658

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Code execution Server Microsoft Sharepoint Server

    8.8 HIGH 2% exploit odds Fix listed
  27. CVE-2026-65663

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Code execution Server Microsoft Sharepoint Server

    8.8 HIGH 2% exploit odds Fix listed
  28. CVE-2026-66805

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Code execution Server Microsoft Sharepoint Server

    8.8 HIGH 2% exploit odds Fix listed
  29. CVE-2026-66808

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Code execution Server Microsoft Sharepoint Server

    8.8 HIGH 2% exploit odds Fix listed
  30. CVE-2026-35439

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Code execution Server Microsoft Sharepoint Server

    8.8 HIGH 2% exploit odds Fix listed
  31. CVE-2026-33110

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Code execution Server Microsoft Sharepoint Server

    8.8 HIGH 2% exploit odds Fix listed
  32. CVE-2026-63516

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

    Code execution Server Microsoft Sharepoint Server

    6.5 MEDIUM 2% exploit odds Fix listed
  33. CVE-2025-21348

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    Microsoft Sharepoint Server

    7.2 HIGH 2% exploit odds Fix listed
  34. CVE-2026-40368

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Code execution Server Microsoft Sharepoint Server

    8.0 HIGH 2% exploit odds Fix listed
  35. CVE-2026-40357

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Code execution Server Microsoft Sharepoint Server

    8.8 HIGH 2% exploit odds Fix listed
  36. CVE-2026-65665

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Code execution Server Microsoft Sharepoint Server

    8.8 HIGH 2% exploit odds Fix listed
  37. CVE-2026-70321

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Code execution Server Microsoft Sharepoint Server

    8.8 HIGH 2% exploit odds Fix listed
  38. CVE-2026-45454

    Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Disclosure Server Microsoft Sharepoint Server

    6.5 MEDIUM 2% exploit odds Fix listed
  39. CVE-2026-26106

    Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Other Server Microsoft Sharepoint Server

    8.8 HIGH 2% exploit odds Fix listed
  40. CVE-2026-85900

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Code execution Server Microsoft Sharepoint Server

    8.8 HIGH 2% exploit odds Fix listed
  41. CVE-2025-30378

    Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.

    Code execution Server Microsoft Sharepoint Server

    7.0 HIGH 1% exploit odds Fix listed
  42. CVE-2025-59228

    Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Other Server Microsoft Sharepoint Server

    8.8 HIGH 1% exploit odds Fix listed
  43. CVE-2025-30384

    Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.

    Code execution Server Microsoft Sharepoint Server

    7.4 HIGH 1% exploit odds Fix listed
  44. CVE-2026-26105

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

    XSS Server Microsoft Sharepoint Server

    8.1 HIGH 1% exploit odds Fix listed
  45. CVE-2025-49701

    Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Code execution Server Microsoft Sharepoint Server

    8.8 HIGH 1% exploit odds Fix listed
  46. CVE-2026-70298

    Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

    Disclosure Server Microsoft Sharepoint Server

    6.5 MEDIUM 1% exploit odds Fix listed
  47. CVE-2026-62837

    Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

    Disclosure Server Microsoft Sharepoint Server

    6.5 MEDIUM 1% exploit odds Fix listed
  48. CVE-2026-85932

    Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

    Disclosure Server Microsoft Sharepoint Server

    6.5 MEDIUM 1% exploit odds Fix listed
  49. CVE-2026-69943

    Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Disclosure Web app Microsoft Sharepoint Server

    8.8 HIGH 1% exploit odds Fix listed
  50. CVE-2026-105719

    Improper input validation in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

    Other Server Microsoft Sharepoint Server

    6.5 MEDIUM 1% exploit odds Fix listed

All CVEs affecting Microsoft Sharepoint Server that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.