https://pwn.watch/t/sharepoint Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Fri, 25 Sep 2026 00:00:00 GMT https://pwn.watch/i/microsoft-sharepoint-cve-2026-65660 https://pwn.watch/i/microsoft-sharepoint-cve-2026-65660 Fri, 25 Sep 2026 00:00:00 GMT high <p>Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. Added to CISA KEV on 2026-09-25.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2026-09-25: CISA added CVE-2026-65660 to the KEV catalog (due 2026-09-28).</li></ul> <p><strong>CVEs:</strong> CVE-2026-65660</p> https://pwn.watch/i/microsoft-sharepoint-cve-2026-55040 https://pwn.watch/i/microsoft-sharepoint-cve-2026-55040 Tue, 18 Aug 2026 00:00:00 GMT high <p>Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network. Added to CISA KEV on 2026-08-18.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2026-08-18: CISA added CVE-2026-55040 to the KEV catalog (due 2026-08-21).</li></ul> <p><strong>CVEs:</strong> CVE-2026-55040</p> https://pwn.watch/i/microsoft-sharepoint-cve-2026-50522 https://pwn.watch/i/microsoft-sharepoint-cve-2026-50522 Wed, 22 Jul 2026 00:00:00 GMT high <p>Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network. Added to CISA KEV on 2026-07-22.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2026-07-22: CISA added CVE-2026-50522 to the KEV catalog (due 2026-07-25).</li></ul> <p><strong>CVEs:</strong> CVE-2026-50522</p> https://pwn.watch/i/microsoft-sharepoint-cve-2026-58644 https://pwn.watch/i/microsoft-sharepoint-cve-2026-58644 Thu, 16 Jul 2026 00:00:00 GMT high <p>Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. Added to CISA KEV on 2026-07-16.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2026-07-16: CISA added CVE-2026-58644 to the KEV catalog (due 2026-07-19).</li></ul> <p><strong>CVEs:</strong> CVE-2026-58644</p> https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-56164 https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-56164 Tue, 14 Jul 2026 00:00:00 GMT high <p>Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network. Added to CISA KEV on 2026-07-14.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2026-07-14: CISA added CVE-2026-56164 to the KEV catalog (due 2026-07-17).</li></ul> <p><strong>CVEs:</strong> CVE-2026-56164</p> https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-45659 https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-45659 Wed, 01 Jul 2026 00:00:00 GMT high <p>Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network. Added to CISA KEV on 2026-07-01.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2026-07-01: CISA added CVE-2026-45659 to the KEV catalog (due 2026-07-04).</li></ul> <p><strong>CVEs:</strong> CVE-2026-45659</p> https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-32201 https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-32201 Tue, 14 Apr 2026 00:00:00 GMT high <p>Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network. Added to CISA KEV on 2026-04-14.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2026-04-14: CISA added CVE-2026-32201 to the KEV catalog (due 2026-04-28).</li></ul> <p><strong>CVEs:</strong> CVE-2026-32201</p> https://pwn.watch/i/microsoft-sharepoint-cve-2026-20963 https://pwn.watch/i/microsoft-sharepoint-cve-2026-20963 Wed, 18 Mar 2026 00:00:00 GMT high <p>Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. Added to CISA KEV on 2026-03-18.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2026-03-18: CISA added CVE-2026-20963 to the KEV catalog (due 2026-03-21).</li></ul> <p><strong>CVEs:</strong> CVE-2026-20963</p> https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770 https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770 Tue, 22 Jul 2025 00:00:00 GMT critical <p>Unauthenticated RCE chain against on-premises SharePoint Server, mass-exploited from July 18, 2025. Microsoft observed Linen Typhoon, Violet Typhoon and Storm-2603 exploiting it; Storm-2603 deployed Warlock ransomware. Patching alone is not enough: rotate ASP.NET machine keys and restart IIS. SharePoint Online was not affected.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See Microsoft customer guidance for CVE-2025-53770</p> <p><strong>Latest updates:</strong></p><ul><li>2025-07-22: Microsoft attributes exploitation to Linen Typhoon, Violet Typhoon and Storm-2603 (<a href="https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/">source</a>)</li><li>2025-07-22: CISA adds CVE-2025-49704 and CVE-2025-49706 to KEV</li><li>2025-07-20: CISA adds CVE-2025-53770 to KEV and publishes guidance (<a href="https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2025-49704, CVE-2025-49706, CVE-2025-53770</p> https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094 https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094 Tue, 22 Oct 2024 00:00:00 GMT high <p>Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution. Added to the CISA KEV catalog on 2024-10-22. CISA lists known use in ransomware campaigns.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2024-10-22: CISA added CVE-2024-38094 to the KEV catalog (federal deadline 2024-11-12) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li><li>2024-07-09: CVE-2024-38094 published (<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-38094">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2024-38094</p> https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-24955 https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-24955 Tue, 26 Mar 2024 00:00:00 GMT high <p>Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely. Added to the CISA KEV catalog on 2024-03-26. CISA lists known use in ransomware campaigns. CVE-2023-24955 was assigned before 2024; the KEV listing came in 2024.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2024-03-26: CISA added CVE-2023-24955 to the KEV catalog (federal deadline 2024-04-16) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2023-24955</p> https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-29357 https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-29357 Wed, 10 Jan 2024 00:00:00 GMT critical <p>Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges. Added to the CISA KEV catalog on 2024-01-10. CISA lists known use in ransomware campaigns. CVE-2023-29357 was assigned before 2024; the KEV listing came in 2024.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2024-01-10: CISA added CVE-2023-29357 to the KEV catalog (federal deadline 2024-01-31) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2023-29357</p>