CVE-2026-32201

Imagine SharePoint as a reception desk that shows “trusted” signs and buttons. This vulnerability lets an attacker forge those signs over the network so victims (and systems) can be tricked into accepting something they shouldn’t—without needing a login. In real attacks, the spoofing is used as a stepping stone to break into the server and do more harmful actions like installing malware.

This matters if your business runs Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, or Microsoft SharePoint Server Subscription Edition (including “SharePoint Server”) on your network. Because the weakness can be triggered remotely without authentication, it’s especially relevant when the SharePoint web endpoints are reachable from the internet or from untrusted networks. This is a risk only when the vulnerable SharePoint service is reachable and available to an attacker on the network.

This is RED because real attackers are actively exploiting CVE-2026-32201, and CISA added it to the KEV catalog with a required action date of 2026-04-28. Since exploitation has been reported in the wild, treating it as “medium risk” would be unsafe—patching to the fixed builds is the immediate priority.