Microsoft SharePoint Server known exploited vulnerabilities, ranked
CISA lists 5 Microsoft SharePoint Server CVEs as exploited in the wild. 3 were added in the last 12 months and 3 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2023-29357: EPSS 99.98%, used in ransomware, added 2024-01-10
- CVE-2023-24955: EPSS 85.0%, used in ransomware, added 2024-03-26
- CVE-2026-32201: EPSS 43.4%, added 2026-04-14
- CVE-2026-45659: EPSS 2.7%, used in ransomware, added 2026-07-01
- CVE-2026-56164: EPSS 1.0%, added 2026-07-14
All 5 Microsoft SharePoint Server CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2023-29357 | SharePoint Server Privilege Escalation | 99.98% | Yes | 2024-01-10 | 2024-01-31 |
| 2 | CVE-2023-24955 | SharePoint Server Code Injection | 85.0% | Yes | 2024-03-26 | 2024-04-16 |
| 3 | CVE-2026-32201 | SharePoint Server Improper Input Validation | 43.4% | – | 2026-04-14 | 2026-04-28 |
| 4 | CVE-2026-45659 | SharePoint Server Deserialization of Untrusted Data | 2.7% | Yes | 2026-07-01 | 2026-07-04 |
| 5 | CVE-2026-56164 | SharePoint Server Missing Authentication for Critical Function | 1.0% | – | 2026-07-14 | 2026-07-17 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Microsoft KEV CVEs · other Microsoft products: SharePoint · Windows · Defender · Internet Explorer · Office · Exchange Server · Win32k · free KEV badge for Microsoft · all vendors