Improper input validation in Microsoft SharePoint Server (CVE-2026-32201) — risk of spoofing over a network

1What spoofing is

"Spoofing" is an attack in which an attacker impersonates another legitimate entity (a user or server) to deceive the other party. This flaw stems from insufficient input validation in Microsoft SharePoint Server, said to let an unauthorized attacker perform such spoofing over a network.

SharePoint is widely used as an enterprise document-sharing and intranet-portal platform where much sensitive information gathers, so spoofing can be a foothold for information theft or unauthorized operations.

2A primary CVSS rating of 6.5

NVD's Primary assessment is CVSS 6.5 (MEDIUM), with limited impact to confidentiality and integrity (C:L/I:L). It is not a direct takeover like remote code execution, but spoofing can widen damage when combined with other attacks. SharePoint has had multiple vulnerabilities exploited in the past, and this joined the KEV as one of them.

3Why a medium score still enters KEV

The number is MEDIUM, but CISA's addition to the KEV shows this flaw is being used in real attacks. Weaknesses in a widely used information platform become real targets regardless of a high or low CVSS. The response is prompt updating per Microsoft's guidance.

4What Microsoft's 386 records divide into

Microsoft leads by vendor among the KEV records this site holds as of 2026-09-01. Split by product name, long-serving platform software occupies the top.

Of the 1,687 records held as of 2026-09-01, Microsoft accounts for 386 across 71 product names. For SharePoint, a second spelling, SharePoint Server, accounts for a further five, bringing it to 14. Because one product is recorded under differing names, grouping by product name has to allow for those variants.

SharePoint is widely used as the platform for document sharing and intranet portals, where a great deal of sensitive information gathers.