Microsoft product
SharePoint Alert ← All Microsoft products
No CISA KEV deadline is open. CISA last added a SharePoint CVE on 25 Sep.
Tracked since 10 Mar · latest article Wed 14 Oct · RSS
CVE Product Added Due · federal deadline
Deadlines passed
CVE-2026-65660 SharePoint 25 Sep Ransomware: Unknown · 5 articles CVE-2026-55040 SharePoint 18 Aug Ransomware: Unknown · 16 articles CVE-2026-50522 SharePoint 22 Jul Ransomware: Unknown · 10 articles CVE-2026-58644 SharePoint 16 Jul Ransomware: Unknown · 14 articles CVE-2026-56164 SharePoint Server 14 Jul Ransomware: Unknown · 11 articles CVE-2026-45659 SharePoint Server 1 Jul Ransomware: Known · 12 articles CVE-2026-32201 SharePoint Server 14 Apr Ransomware: Unknown · 14 articles CVE-2026-20963 SharePoint 18 Mar Ransomware: Unknown · 5 articles CVE-2025-49704 SharePoint 22 Jul 2025 Ransomware: Known · 1 article CVE-2025-49706 SharePoint 22 Jul 2025 Ransomware: Known · 1 article 5 earlier entries CVE-2025-53770 SharePoint 20 Jul 2025 Ransomware: Known · 3 articles CVE-2024-38094 not in CyberSIXT coverage SharePoint 22 Oct 2024 Ransomware: Known · 0 articles CVE-2023-24955 not in CyberSIXT coverage SharePoint Server 26 Mar 2024 Ransomware: Known · 0 articles CVE-2023-29357 not in CyberSIXT coverage SharePoint Server 10 Jan 2024 Ransomware: Known · 0 articles CVE-2019-0604 not in CyberSIXT coverage SharePoint 3 Nov 2021 Ransomware: Known · 0 articles 88 articles from 13 outlets; the latest 12 days ago.
SharePoint: coverage over time 88 articles from 13 outlets. Busiest week: 20 articles, week of 13 Jul. 0 in the last 7 days.
May Jul Sep 10 Feb Now 88 per week Added to CISA KEV · CVE-2026-65660 SharePoint Added to CISA KEV · CVE-2026-55040 SharePoint SharePoint: coverage over time 88 articles from 13 outlets. Busiest week: 20 articles, week of 13 Jul. 0 in the last 7 days.
Apr May Jun Jul Aug Sep 10 Feb Now 88 per week Added to CISA KEV · CVE-2026-65660 SharePoint Added to CISA KEV · CVE-2026-55040 SharePoint Added to CISA KEV · CVE-2026-50522 SharePoint Added to CISA KEV · CVE-2026-20963 SharePoint
Show as table SharePoint: articles Published (UTC) Outlet Headline Wed 14 Oct · 14:37 UTC Security Affairs Microsoft fixes 1,415 flaws as exploited Windows bug puts users at risk Tue 13 Oct · 23:01 UTC Dark Reading Microsoft patches actively exploited Windows flaw that bypasses security checks Tue 13 Oct · 21:13 UTC thezdi.com Adobe and Microsoft Patch Thousands of Flaws in Record Update Fri 2 Oct · 10:05 UTC SecurityWeek Warlock Ransomware Expands SharePoint Attacks Against Critical Sectors Sun 27 Sep · 09:46 UTC SecurityWeek Attackers Exploit Patched Microsoft SharePoint Flaw to Deploy Webshells Fri 25 Sep · 21:31 UTC Security Affairs CISA Warns of Active MikroTik RouterOS Attacks and SharePoint Flaw Fri 25 Sep · 17:00 UTC CISA CISA Flags Actively Exploited SharePoint and MikroTik Flaws Fri 25 Sep · 16:01 UTC CISA CISA Warns of Actively Exploited Microsoft SharePoint Code Flaw Fri 25 Sep · 08:23 UTC SecurityOnline Attackers Exploit SharePoint Flaw to Deploy Stealthy Web Shells Tue 8 Sep · 21:30 UTC Ars Technica Microsoft’s Record 972-Flaw Patch Haul Includes Two Zero-Days Tue 8 Sep · 19:47 UTC SecurityWeek Microsoft Fixes 974 Flaws in Record Patch Tuesday Update Tue 25 Aug · 15:50 UTC SecurityOnline Critical SharePoint RCE and Auth Bypass Flaws Actively Exploited Tue 25 Aug · 00:11 UTC Rapid7 Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520) Wed 19 Aug · 14:02 UTC SecurityOnline Telegram seeks .gram domain as critical zero day exploits surge Wed 19 Aug · 14:01 UTC SecurityOnline Urgent Patches Address Flaws in Microsoft, Apple, IBM Db2 Wed 19 Aug · 14:00 UTC SecurityOnline Google patches Android ContactsProvider2 SQLi high severity bug Wed 19 Aug · 11:01 UTC SecurityWeek CISA warns of active exploits in Microsoft, VMware, Apple bugs Wed 19 Aug · 08:01 UTC Security Affairs U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog Wed 19 Aug · 00:03 UTC CISA CISA Urges Patching of Microsoft SharePoint Flaw CVE-2026-55040 Tue 18 Aug · 19:43 UTC CISA CISA flags critical SharePoint auth bypass CVE-2026-55040 in KEV Thu 13 Aug · 09:21 UTC Security Affairs SharePoint Zero Day Flaw Exploited After Rapid7 PoC Release Wed 12 Aug · 15:21 UTC SecurityWeek SharePoint Auth Bypass Flaw CVE-2026-55040 Under Active Attack Wed 12 Aug · 09:52 UTC SecurityOnline Critical SharePoint JWT flaw lets attackers bypass authentication Wed 12 Aug · 00:47 UTC Rapid7 Microsoft Fixes 421 Flaws Including SharePoint Zero Day Tue 11 Aug · 14:51 UTC Rapid7 CVE-2026-55040: SharePoint flaw lets attackers forge admin tokens Tue 11 Aug · 14:51 UTC Rapid7 Rapid7 Finds Critical SharePoint RCE Flaw Tied to Auth Bypass Mon 27 Jul · 02:21 UTC SecurityOnline UK firms must patch now as CISA flags six active exploits Thu 23 Jul · 21:01 UTC Security Affairs U.S. CISA adds Microsoft SharePoint and Check Point SmartConsole flaws to its Known Exploited Vulnerabilities catalog Thu 23 Jul · 04:07 UTC SecurityOnline Two Active BIND Exploits Highlighted as Nine Flaws Patched Thu 23 Jul · 04:06 UTC SecurityOnline GitHub Actions Abused to Steal Credentials from PHP Packages Wed 22 Jul · 22:03 UTC CISA CISA Flags CVE-2026-50522 in KEV, Warns of SharePoint RCE Risk Wed 22 Jul · 20:21 UTC CISA CISA Adds CVE-2026-50522 to Known Exploited Vulnerabilities Catalogue Wed 22 Jul · 11:40 UTC SecurityWeek Fourth SharePoint Vulnerability Exploited in Past Month’s Wave of Attacks Tue 21 Jul · 22:56 UTC Security Affairs CVE-2026-50522: SharePoint Flaw Lets Site Owners Run Remote Code Tue 21 Jul · 15:20 UTC The Hacker News SharePoint flaw CVE-2026-50522 under active attack after PoC leak Sat 18 Jul · 12:51 UTC Security Affairs CISA urges patch of FortiSandbox, SharePoint flaws amid exploits Sat 18 Jul · 10:01 UTC SecurityOnline Ubuntu Pro Client Flaw CVE-2026-11386 Allows Arbitrary Code Execution With Root Privileges Fri 17 Jul · 20:26 UTC Rapid7 Attackers exploit Critical SharePoint RCE flaw CVE-2026-58644 Fri 17 Jul · 10:01 UTC SecurityOnline 292 Fake GitHub Repositories Deliver BoryptGrab Infostealer to Windows Users Fri 17 Jul · 07:40 UTC SecurityWeek Critical SharePoint Flaw Exploited, CISA Urges Immediate Patching Fri 17 Jul · 07:40 UTC The Hacker News CISA Adds SharePoint Zero Day Exploit CVE-2026-58644 to KEV Catalog Fri 17 Jul · 04:51 UTC SecurityOnline Red Hat OpenShift AI flaw lets attackers read local files Fri 17 Jul · 04:50 UTC SecurityOnline CISA orders urgent patches for SharePoint, FortiSandbox flaws Thu 16 Jul · 18:39 UTC CISA CISA Adds Critical SharePoint Flaw CVE-2026-58644 to KEV Thu 16 Jul · 17:37 UTC CISA CISA Adds Critical SharePoint Flaw CVE-2026-58644 to KEV Wed 15 Jul · 19:20 UTC SecurityOnline Microsoft, SonicWall bugs found; RabbitMQ patches auth flaws Wed 15 Jul · 14:23 UTC SecurityWeek CISA urges swift patching of SharePoint after zero day exploits Wed 15 Jul · 12:41 UTC Malwarebytes Microsoft patches 622 flaws, fixes three critical zero day bugs Wed 15 Jul · 00:51 UTC Rapid7 Patch Tuesday - July 2026 Wed 15 Jul · 00:50 UTC SecurityOnline Microsoft patches 570 flaws, two zero days actively exploited
Who reported 13 outlets, last 12 months
18 16 13 12 8 7 14 See the full timeline 14 Oct Microsoft fixes 1,415 flaws as exploited Windows bug puts users at risk Security Affairs 13 Oct Microsoft patches actively exploited Windows flaw that bypasses security checks Dark Reading 13 Oct Adobe and Microsoft Patch Thousands of Flaws in Record Update thezdi.com 2 Oct Warlock Ransomware Expands SharePoint Attacks Against Critical Sectors SecurityWeek 27 Sep Attackers Exploit Patched Microsoft SharePoint Flaw to Deploy Webshells SecurityWeek 25 Sep CISA Warns of Active MikroTik RouterOS Attacks and SharePoint Flaw Security Affairs 25 Sep CISA Flags Actively Exploited SharePoint and MikroTik Flaws CISA · official notice 25 Sep CISA Warns of Actively Exploited Microsoft SharePoint Code Flaw CISA · official notice 25 Sep Attackers Exploit SharePoint Flaw to Deploy Stealthy Web Shells SecurityOnline 8 Sep Microsoft’s Record 972-Flaw Patch Haul Includes Two Zero-Days Ars Technica
All CVEs in coverage 16 Exploited EPSS CVSS Newest CVE-2025-53770 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CVSS 9.8 Critical Exploited 99.9% EPSS 3 articles CVE-2025-49704 Microsoft SharePoint Code Injection Vulnerability CVSS 8.8 High Exploited 99.9% EPSS 1 article CVE-2025-49706 Microsoft SharePoint Improper Authentication Vulnerability CVSS 6.5 Medium Exploited 99.0% EPSS 1 article CVE-2026-55040 Microsoft SharePoint Weak Authentication Vulnerability CVSS 9.1 Critical Exploited 70% EPSS 16 articles CVE-2026-32201 Microsoft SharePoint Server Improper Input Validation Vulnerability CVSS 6.5 Medium Exploited 43% EPSS 14 articles CVE-2026-20963 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CVSS 9.8 Critical Exploited 29% EPSS 5 articles CVE-2026-58644 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CVSS 9.8 Critical Exploited 16% EPSS 14 articles CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerability CVSS 8.8 High Exploited 8.2% EPSS 5 articles CVE-2026-50522 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CVSS 9.8 Critical Exploited 3.0% EPSS 10 articles CVE-2026-45659 Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability CVSS 8.8 High Exploited 2.7% EPSS 12 articles CVE-2026-56164 Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability CVSS 5.3 Medium Exploited 1.0% EPSS 11 articles CVE-2025-53771 Microsoft SharePoint Server Spoofing Vulnerability CVSS 6.5 Medium – Not in KEV 99.8% EPSS 0 articles 4 more CVEs CVE-2026-33112 Microsoft SharePoint Enterprise Server 2016 vulnerability CVSS 8.8 High – Not in KEV 31% EPSS 1 article CVE-2026-63520 Microsoft SharePoint Enterprise Server 2016 vulnerability CVSS 8.1 High – Not in KEV 1.0% EPSS 5 articles CVE-2026-69465 Microsoft SharePoint Server Subscription Edition vulnerability CVSS 8.8 High – Not in KEV 0.8% EPSS 2 articles CVE-2026-102866 Microsoft SharePoint Server Subscription Edition vulnerability CVSS 8.1 High – Not in KEV 0.7% EPSS 3 articles How these numbers are made CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.
CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.
Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.
Product names are grouped by normalised names, with version and edition tails removed.
Fix listed refers to an advisory. Unknown fix status is counted as not listed.