Overview A critical spoofing vulnerability in Microsoft SharePoint Server (CVE‑2026‑32201) remains unpatched on more than 1,370 internet‑facing servers worldwide, despite being added to CISA’s Known Exploited Vulnerabilities (KEV) catalog with confirmed active exploitation. The flaw, disclosed on April 14, 2026, allows unauthenticated attackers to impersonate legitimate users and manipulate sensitive organizational data.
Key Highlights
- Vulnerability: Improper input validation in SharePoint’s request processing component (CWE‑20).
- Impact: Attackers can bypass authentication, view sensitive data, and make unauthorized changes.
- Severity: CVSS 6.5 (Medium), but real‑world risk is far higher due to pre‑auth exploitation.
- Affected Versions: SharePoint Server 2016, 2019, and Subscription Edition.
- Exposure: Shadowserver scans show 1,370 unpatched IPs as of April 20, 2026.
- Geographic Breakdown:
- North America: 677 (U.S. alone 587)
- Europe: 452
- Asia: 144
- Oceania: 33
- South America: 33
- Africa: 31
Attack Characteristics
- Attack Vector: Fully network‑based (AV:N).
- Complexity: Low (AC:L).
- Privileges Required: None (PR:N).
- User Interaction: None (UI:N).
- Outcome: Credential theft, data exfiltration, unauthorized document access, and potential lateral movement.
Risks to Enterprises
- Wide Exposure: Over 1,300 servers still vulnerable globally.
- Confirmed Exploitation: Active campaigns already targeting unpatched SharePoint deployments.
- Operational Impact: Unauthorized access to sensitive collaboration data.
- Federal Deadline: CISA requires remediation by April 28, 2026 for U.S. federal agencies.
Mitigation Guidance
- Patch Immediately: Apply April 2026 security updates for all supported SharePoint Server versions.
- Audit Deployments: Identify and restrict internet‑facing SharePoint instances.
- Monitor Authentication Logs: Look for spoofed session indicators or anomalous activity.
- Cross‑Reference KEV: Prioritize CVE‑2026‑32201 remediation before the federal deadline.
- Leverage Shadowserver Reports: Use free scanning data to identify vulnerable assets.
Final Thought
Despite its “Medium” CVSS score, CVE‑2026‑32201 is high‑risk in practice: pre‑authentication exploitation means any exposed SharePoint server is a potential target. With over a thousand systems still vulnerable, organizations face an urgent remediation window before attackers escalate campaigns. The lesson is clear: patch quickly, restrict exposure, and monitor for spoofing activity to safeguard collaboration platforms.
Leave a Reply