Microsoft SharePoint security vulnerabilities
Enterprise software. Public CVE monitoring for Microsoft SharePoint. Vendor security advisories are linked on this page.
Built for Operators of this product.
494 public records · 0 security-fix timeline events. 2 published in the last 7 days. 489 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 0
- High 51
- Medium 32
- Low 1
2026-08-0584 issues2026-11-02
Known exploited
View all known exploited- Critical9.8Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityPatch nowKEVEPSS 100.00%Jul 18, 2025
- High8.8Microsoft SharePoint Code Injection VulnerabilityPatch nowKEVEPSS 100.00%Jul 8, 2025
- Medium6.5Microsoft SharePoint Improper AuthenticationPatch nowKEVEPSS 99.89%Jul 18, 2025
- Medium6.5Microsoft SharePoint Improper Authentication VulnerabilityPatch nowKEVEPSS 99.06%Jul 8, 2025
- High8.8Microsoft SharePoint Server Deserialization of Untrusted Data VulnerabilityPatch nowKEVEPSS 80.24%May 22, 2026
- Critical9.1Microsoft SharePoint Weak Authentication VulnerabilityPatch nowKEVEPSS 69.54%Jul 14, 2026
- Medium6.5Microsoft SharePoint Server Improper Input Validation VulnerabilityPatch nowKEVEPSS 43.38%Apr 12, 2026
- Critical9.8Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityPatch nowKEVEPSS 29.20%Jan 13, 2026
Recently published
Browse catalog- High7.9An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP).Check if you run itEPSS 0.34%Oct 30, 2026
- High8.5A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled daCheck if you run itEPSS 0.24%Oct 30, 2026
- High8.8Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.Check if you run itEPSS 0.82%Oct 15, 2026
- Medium6.5Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.Check if you run itEPSS 0.92%Oct 13, 2026
- High8.8Microsoft Office SharePoint Elevation of Privilege VulnerabilityCheck if you run itEPSS 1.08%Oct 13, 2026
- High7.5Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 0.61%Oct 13, 2026
- High7.2Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.Check if you run itEPSS 1.01%Oct 13, 2026
- High8.8Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.Check if you run itEPSS 1.16%Oct 13, 2026
- Medium6.5Improper input validation in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.Check if you run itEPSS 1.09%Oct 13, 2026
- Medium4.3Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 0.49%Oct 13, 2026