Microsoft SharePoint known exploited vulnerabilities, ranked
CISA lists 10 Microsoft SharePoint CVEs as exploited in the wild. 5 were added in the last 12 months and 5 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2025-53770: EPSS 100.00%, used in ransomware, added 2025-07-20
- CVE-2025-49704: EPSS 100.00%, used in ransomware, added 2025-07-22
- CVE-2019-0604: EPSS 99.91%, used in ransomware, added 2021-11-03
- CVE-2025-49706: EPSS 99.08%, used in ransomware, added 2025-07-22
- CVE-2024-38094: EPSS 50.9%, used in ransomware, added 2024-10-22
All 10 Microsoft SharePoint CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2025-53770 | SharePoint Deserialization of Untrusted Data | 100.00% | Yes | 2025-07-20 | 2025-07-21 |
| 2 | CVE-2025-49704 | SharePoint Code Injection | 100.00% | Yes | 2025-07-22 | 2025-07-23 |
| 3 | CVE-2019-0604 | SharePoint Remote Code Execution | 99.91% | Yes | 2021-11-03 | 2022-05-03 |
| 4 | CVE-2025-49706 | SharePoint Improper Authentication | 99.08% | Yes | 2025-07-22 | 2025-07-23 |
| 5 | CVE-2024-38094 | SharePoint Deserialization | 50.9% | Yes | 2024-10-22 | 2024-11-12 |
| 6 | CVE-2026-20963 | SharePoint Deserialization of Untrusted Data | 29.6% | – | 2026-03-18 | 2026-03-21 |
| 7 | CVE-2026-55040 | SharePoint Weak Authentication | 17.5% | – | 2026-08-18 | 2026-08-21 |
| 8 | CVE-2026-58644 | SharePoint Deserialization of Untrusted Data | 15.9% | – | 2026-07-16 | 2026-07-19 |
| 9 | CVE-2026-50522 | SharePoint Deserialization of Untrusted Data | 3.0% | – | 2026-07-22 | 2026-07-25 |
| 10 | CVE-2026-65660 | SharePoint Code Injection | 2.1% | – | 2026-09-25 | 2026-09-28 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Microsoft KEV CVEs · other Microsoft products: Windows · SharePoint Server · Defender · Internet Explorer · Office · Exchange Server · Win32k · free KEV badge for Microsoft · all vendors