Known vulnerabilities in Microsoft SharePoint Enterprise Server 2016

Vendor: Microsoft
Software: Microsoft SharePoint Enterprise Server
Version: 2016
Software CPE: cpe:2.3:a:microsoft:microsoft_sharepoint_enterprise_server:*:*:*:*:*:*:*:*
Website: https://www.microsoft.com
Total vulnerabilities: 111
Public exploits: 4
Known exploited (KEV): 3
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Microsoft SharePoint Enterprise Server version 2016 Microsoft SharePoint Enterprise Server 2016 is affected by 111 vulnerabilities: 33 high, 63 medium, 15 low Critical High Medium Low

Vulnerabilities (111)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU134498 - Heap-based Buffer Overflow
CVE-2026-44824		 CWE-122 High
No
No
 - 15.06.2026 SB2026061527
#VU134497 - Out-of-bounds read
CVE-2026-44821		 CWE-125 Medium
No
No
 - 15.06.2026 SB2026061527
#VU134496 - Heap-based Buffer Overflow
CVE-2026-44819		 CWE-122 High
No
No
 - 15.06.2026 SB2026061527
#VU134495 - Out-of-bounds read
CVE-2026-45485		 CWE-125 Medium
No
No
 - 15.06.2026 SB2026061527
#VU134489 - Heap-based Buffer Overflow
CVE-2026-45475		 CWE-122 High
No
No
 - 15.06.2026 SB2026061527
#VU134244 - Use After Free
CVE-2026-45458		 CWE-416 High
No
No
 - 10.06.2026 SB2026061097
#VU134228 - Type confusion
CVE-2026-45456		 CWE-843 High
No
No
 - 10.06.2026 SB2026061097
#VU134213 - Untrusted Pointer Dereference
CVE-2026-45471		 CWE-822 High
No
No
 - 10.06.2026 SB2026061062
#VU122587 - Deserialization of Untrusted Data
CVE-2026-21511		 CWE-502 Medium
No
No
 - 10.02.2026 SB2026021093
#VU122586 - Exposure of sensitive information to an unauthorized actor
CVE-2026-21260		 CWE-200 Medium
No
No
 - 10.02.2026 SB2026021093
#VU121459 - Untrusted Pointer Dereference
CVE-2026-20948		 CWE-822 High
No
No
 - 14.01.2026 SB20260114105
#VU121455 - Untrusted Search Path
CVE-2026-20943		 CWE-426 High
No
No
 - 14.01.2026 SB20260114104
#VU121422 - Deserialization of Untrusted Data
CVE-2026-20963		 CWE-502 Medium
No
Exploited
 - 14.01.2026 SB2026011474
#VU121420 - Server-Side Request Forgery (SSRF)
CVE-2026-20958		 CWE-918 Medium
No
No
 - 14.01.2026 SB2026011474
#VU121327 - Improper input validation
CVE-2026-20951		 CWE-20 High
No
No
 - 13.01.2026 SB20260113125
#VU121326 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-20959		 CWE-79 Low
No
No
 - 13.01.2026 SB20260113125
#VU121324 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-20947		 CWE-89 Medium
No
No
 - 13.01.2026 SB20260113125
#VU119495 - Use After Free
CVE-2025-62559		 CWE-416 High
No
No
 - 09.12.2025 SB2025120993
#VU119494 - Use After Free
CVE-2025-62558		 CWE-416 High
No
No
 - 09.12.2025 SB2025120993
#VU119493 - Use After Free
CVE-2025-62555		 CWE-416 High
No
No
 - 09.12.2025 SB2025120993


Showing elements 1 - 20 out of 111