Known vulnerabilities in Microsoft SharePoint Server 2016

Vendor: Microsoft
Software: Microsoft SharePoint Server
Version: 2016
Software CPE: cpe:2.3:a:microsoft:microsoft_sharepoint_server:*:*:*:*:*:*:*:*
Website: https://www.microsoft.com
Total vulnerabilities: 265
Public exploits: 13
Known exploited (KEV): 4
Highest CVSSv4 Score: 9.4

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Microsoft SharePoint Server version 2016 Microsoft SharePoint Server 2016 is affected by 265 vulnerabilities: 1 critical, 50 high, 97 medium, 117 low Critical High Medium Low

Vulnerabilities (265)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU115125 - Use After Free
CVE-2025-54906		 CWE-416 High
No
No
 - 10.09.2025 SB2025091012
#VU114038 - Out-of-bounds read
CVE-2025-53736		 CWE-125 Low
No
No
 - 13.08.2025 SB2025081388
#VU113096 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-53771		 CWE-22 Medium
Public exploit available
Exploited
 16.0.5513.1001, 16.0.10417.20037, 16.0.18526.20508 22.07.2025 SB2025072201
#VU113075 - Deserialization of Untrusted Data
CVE-2025-53770		 CWE-502 Critical
Public exploit available
Exploited
 16.0.10417.20037, 16.0.18526.20508 20.07.2025 SB2025072001
#VU88380 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-26251		 CWE-79 Low
No
No
 - 10.04.2024 SB2024041036
#VU86051 - Permissions, Privileges, and Access Controls
CVE-2021-43876		 CWE-264 Medium
No
No
 - 04.02.2024 SB2021121736
#VU72229 - Improper Access Control
CVE-2023-21717		 CWE-284 Medium
No
No
 - 15.02.2023 SB2023021512
#VU62149 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2022-24472		 CWE-451 Medium
No
No
 - 12.04.2022 SB2022041247
#VU60410 - Deserialization of Untrusted Data
CVE-2022-22005		 CWE-502 Medium
No
No
 - 08.02.2022 SB2022020838
#VU59476 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-21840		 CWE-94 High
No
No
 - 11.01.2022 SB2022011159
#VU59443 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-21842		 CWE-94 High
No
No
 - 11.01.2022 SB2022011132
#VU59440 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-21837		 CWE-94 Medium
No
No
 - 11.01.2022 SB2022011131
#VU58915 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2021-43242		 CWE-451 Medium
No
No
 - 14.12.2021 SB2021121449
#VU58914 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2021-42320		 CWE-451 Medium
No
No
 - 14.12.2021 SB2021121449
#VU58912 - Improper input validation
CVE-2021-42309		 CWE-20 High
No
No
 - 14.12.2021 SB2021121449
#VU58911 - Improper input validation
CVE-2021-42294		 CWE-20 High
No
No
 - 14.12.2021 SB2021121449
#VU57261 - Use After Free
CVE-2021-40486		 CWE-416 High
No
No
 - 12.10.2021 SB2021101216
#VU57248 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-41344		 CWE-94 Medium
No
No
 - 12.10.2021 SB2021101210
#VU57246 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2021-40484		 CWE-451 Medium
No
No
 - 12.10.2021 SB2021101210
#VU57245 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-40487		 CWE-94 Medium
No
No
 - 12.10.2021 SB2021101210


Showing elements 1 - 20 out of 265