Known vulnerabilities in Microsoft SharePoint Server

Vendor: Microsoft
Software: Microsoft SharePoint Server
Software CPE: cpe:2.3:a:microsoft:microsoft_sharepoint_server:*:*:*:*:*:*:*:*
Website: https://www.microsoft.com
Total vulnerabilities: 548
Public exploits: 25
Known exploited (KEV): 19
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Microsoft SharePoint Server Microsoft SharePoint Server is affected by 548 known vulnerabilities: 4 critical, 122 high, 218 medium, 204 low Critical High Medium Low

Vulnerabilities (548)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU148011 - Server-Side Request Forgery (SSRF)
CVE-2026-69904		 CWE-918 Low
No
No
 16.0.20326.20082 09.09.2026 SB2026090912
#VU147963 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVE-2026-69804		 CWE-367 Low
No
No
 16.0.20326.20090 08.09.2026 SB2026090911
#VU147914 - Missing Authorization
CVE-2026-69724		 CWE-862 Medium
No
No
 16.0.20326.20090 08.09.2026 SB2026090911
#VU147907 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-69716		 CWE-89 Medium
No
No
 16.0.20326.20094 08.09.2026 SB2026090914
#VU147892 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-69690		 CWE-79 Low
No
No
 16.0.20326.20090 08.09.2026 SB2026090911
#VU147885 - Server-Side Request Forgery (SSRF)
CVE-2026-69683		 CWE-918 Low
No
No
 16.0.20326.20082 08.09.2026 SB2026090912
#VU147865 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-69636		 CWE-89 Low
No
No
 16.0.20326.20082 08.09.2026 SB2026090912
#VU147848 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-69615		 CWE-79 Low
No
No
 16.0.20326.20090 08.09.2026 SB2026090911
#VU147718 - Missing Authorization
CVE-2026-69465		 CWE-862 Medium
No
No
 16.0.20326.20074 08.09.2026 SB2026090913
#VU147717 - Execution with Unnecessary Privileges
CVE-2026-69464		 CWE-250 Medium
No
No
 16.0.20326.20090 08.09.2026 SB2026090911
#VU147676 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-69417		 CWE-79 Low
No
No
 16.0.20326.20090 08.09.2026 SB2026090911
#VU147670 - Execution with Unnecessary Privileges
CVE-2026-69409		 CWE-250 Low
No
No
 16.0.20326.20090 08.09.2026 SB2026090911
#VU147663 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-69402		 CWE-79 Low
No
No
 16.0.20326.20090 08.09.2026 SB2026090911
#VU147555 - Improper Access Control
CVE-2026-69282		 CWE-284 Medium
No
No
 16.0.20326.20090 08.09.2026 SB2026090911
#VU147547 - Improper Access Control
CVE-2026-69273		 CWE-284 Medium
No
No
 16.0.20326.20082 08.09.2026 SB2026090912
#VU147542 - Improper Access Control
CVE-2026-69268		 CWE-284 Medium
No
No
 16.0.20326.20090 08.09.2026 SB2026090911
#VU142001 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-70306		 CWE-79 Medium
No
No
 16.0.5561.1001, 16.0.10417.20175, 16.0.19725.20434 12.08.2026 SB20260812237
#VU141855 - Server-Side Request Forgery (SSRF)
CVE-2026-70324		 CWE-918 Medium
No
No
 16.0.5565.1001, 16.0.10417.20198, 16.0.19725.20522 12.08.2026 SB20260812230
#VU141846 - Deserialization of Untrusted Data
CVE-2026-70321		 CWE-502 Medium
No
No
 16.0.19725.20522 12.08.2026 SB20260812230
#VU141734 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-57105		 CWE-79 Low
No
No
 16.0.10417.20198, 16.0.19725.20522 12.08.2026 SB20260812230


Showing elements 1 - 20 out of 548