Microsoft SharePoint Flaws Expose Internet-Facing Servers to Spoofing and RCE Risk

More than 1,370 internet-facing Microsoft SharePoint servers were reported exposed to active exploitation of CVE-2026-32201, a spoofing vulnerability affecting SharePoint Server 2016, 2019, and Subscription Edition. Microsoft disclosed the flaw in April and CISA added it to the Known Exploited Vulnerabilities catalog the same day, underscoring the urgency for defenders. Although Microsoft scored the bug at CVSS 6.5, the risk is elevated because it can be exploited remotely without authentication against exposed on-premises deployments, potentially allowing attackers to impersonate users, access or alter sensitive content, steal credentials, and move laterally inside victim environments.

The exposure comes amid broader concern over SharePoint security, including Microsoft's disclosure of CVE-2026-26106, a remote code execution vulnerability in SharePoint Server, and earlier reporting that a China-linked threat actor was involved in SharePoint attacks, according to Mandiant. The concentration of exposed systems was highest in the United States, and the combined reporting points to sustained attacker interest in SharePoint as a route into enterprise networks. Organizations were urged to apply Microsoft's available updates, reduce direct internet exposure of SharePoint servers, and closely monitor authentication and document-access activity for signs of compromise.