Product of Microsoft

SharePoint Server

As of , 5 Microsoft SharePoint Server vulnerabilities are on CISA's list of exploited vulnerabilities, 3 of them used in ransomware campaigns; 3 were added in 2026. Patch first: CVE-2026-45659.

Patch first

Patch first
#VulnerabilityProductOur groupListedDeadlineEPSS
1CVE-2026-45659Deserialization of Untrusted DataMicrosoft SharePoint ServerPatch nowForensic triage required by CISA; ransomware use, listed within a year0.03
2CVE-2026-56164Missing Authentication for Critical FunctionMicrosoft SharePoint ServerPatch nowForensic triage required by CISA0.01
3CVE-2023-24955Code InjectionMicrosoft SharePoint ServerPatch this weekRansomware use; Metasploit module; EPSS 0.850.85
4CVE-2023-29357Privilege EscalationMicrosoft SharePoint ServerPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
5CVE-2026-32201Improper Input ValidationMicrosoft SharePoint ServerPatch soon0.43

Added each year

1232024: 2220242025: nonenone20252026: 332026
Entries CISA added each year, removed ones included. Source: CISA KEV.
Show the numbers
Periodentries added
20242
2025none
20263

Used in ransomware

Changes CISA made to these entries

  1. CVE-2026-45659 Microsoft SharePoint ServerRansomware use: Unknown to Known.

Every change we recorded