# SharePoint security incidents · pwn.watch

> Security incidents tagged SharePoint (vendor, product, platform or attack type).

Page: https://pwn.watch/t/sharepoint · generated 2026-10-22T16:23:59.585Z

## Status (as of 2026-10-22)
- Incidents: 12 (0 live, 0 live and not fully patched, 12 patched)
- Days without a SharePoint security incident: 27
- Newest incident started: 2026-09-25

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/sharepoint.json
- RSS (every update): https://pwn.watch/t/sharepoint/feed.xml
- This file: https://pwn.watch/t/sharepoint/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [Microsoft SharePoint: Microsoft SharePoint Code Injection Vulnerability](https://pwn.watch/i/microsoft-sharepoint-cve-2026-65660) ([json](https://pwn.watch/i/microsoft-sharepoint-cve-2026-65660.json)): high, closed, patched, started 2026-09-25, CVE-2026-65660
- [Microsoft SharePoint: Microsoft SharePoint Weak Authentication Vulnerability](https://pwn.watch/i/microsoft-sharepoint-cve-2026-55040) ([json](https://pwn.watch/i/microsoft-sharepoint-cve-2026-55040.json)): high, closed, patched, started 2026-08-18, CVE-2026-55040
- [Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability ](https://pwn.watch/i/microsoft-sharepoint-cve-2026-50522) ([json](https://pwn.watch/i/microsoft-sharepoint-cve-2026-50522.json)): high, closed, patched, started 2026-07-22, CVE-2026-50522
- [Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/microsoft-sharepoint-cve-2026-58644) ([json](https://pwn.watch/i/microsoft-sharepoint-cve-2026-58644.json)): high, closed, patched, started 2026-07-16, CVE-2026-58644
- [Microsoft SharePoint Server: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability](https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-56164) ([json](https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-56164.json)): high, closed, patched, started 2026-07-14, CVE-2026-56164
- [Microsoft SharePoint Server: Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-45659) ([json](https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-45659.json)): high, closed, patched, started 2026-07-01, CVE-2026-45659
- [Microsoft SharePoint Server: Microsoft SharePoint Server Improper Input Validation Vulnerability](https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-32201) ([json](https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-32201.json)): high, closed, patched, started 2026-04-14, CVE-2026-32201
- [Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/microsoft-sharepoint-cve-2026-20963) ([json](https://pwn.watch/i/microsoft-sharepoint-cve-2026-20963.json)): high, closed, patched, started 2026-03-18, CVE-2026-20963
- [ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)](https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770) ([json](https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770.json)): critical, closed, patched, started 2025-07-18, CVE-2025-49704, CVE-2025-49706, CVE-2025-53770
- [Microsoft SharePoint Deserialization](https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094) ([json](https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094.json)): high, closed, patched, started 2024-07-09, CVE-2024-38094
- [Microsoft SharePoint Server Code Injection](https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-24955) ([json](https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-24955.json)): high, closed, patched, started 2024-03-26, CVE-2023-24955
- [Microsoft SharePoint Server Privilege Escalation](https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-29357) ([json](https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-29357.json)): critical, closed, patched, started 2024-01-10, CVE-2023-29357