Product by Microsoft
Microsoft SharePoint Server Subscription Edition
632 known vulnerabilities in Microsoft SharePoint Server Subscription Edition (Microsoft), 20 of them actively exploited (CISA KEV).
Key figures
632
Vulnerabilities
20
Actively exploited (KEV)
8
Used by ransomware
28
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2025-53770 | Microsoft SharePoint Server Remote Code Execution Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2025-49704 | Microsoft SharePoint Remote Code Execution Vulnerability In CISA KEVRansomware | 8.8 | |
| Critical | CVE-2023-29357 | Microsoft SharePoint Server Elevation of Privilege Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2019-0604 | Microsoft SharePoint Remote Code Execution Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2026-45659 | Microsoft SharePoint Remote Code Execution Vulnerability In CISA KEVRansomware | 8.8 | |
| Critical | CVE-2025-49706 | Microsoft SharePoint Server Spoofing Vulnerability In CISA KEVRansomware | 6.5 | |
| Critical | CVE-2026-55040 | Microsoft SharePoint Server Security Feature Bypass Vulnerability In CISA KEV | 9.1 | |
| Critical | CVE-2026-58644 | Microsoft SharePoint Remote Code Execution Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2024-38094 | Microsoft SharePoint Remote Code Execution Vulnerability In CISA KEVRansomware | 7.2 | |
| Critical | CVE-2023-24955 | Microsoft SharePoint Server Remote Code Execution Vulnerability In CISA KEVRansomware | 7.2 | |
| Critical | CVE-2026-20963 | Microsoft SharePoint Remote Code Execution Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2026-50522 | Microsoft SharePoint Remote Code Execution Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2026-32201 | Microsoft SharePoint Server Spoofing Vulnerability In CISA KEV | 6.5 | |
| Critical | CVE-2026-65660 | Microsoft SharePoint Server Remote Code Execution Vulnerability In CISA KEV | 8.8 | |
| Critical | CVE-2015-1641 | Microsoft Office Memory Corruption Vulnerability In CISA KEV | 7.8 | |
| Critical | CVE-2020-1147 | Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability In CISA KEV | 7.8 | |
| Critical | CVE-2017-11826 | Microsoft Office Remote Code Execution Vulnerability In CISA KEV | 7.8 | |
| Critical | CVE-2014-1761 | Microsoft Word Memory Corruption Vulnerability In CISA KEV | 7.8 | |
| Critical | CVE-2012-2539 | Microsoft Word Remote Code Execution Vulnerability In CISA KEV | 7.8 | |
| Critical | CVE-2026-56164 | Microsoft SharePoint Server Elevation of Privilege Vulnerability In CISA KEV | 5.3 | |
| High | CVE-2026-20947 | Microsoft SharePoint Server Remote Code Execution Vulnerability | 8.8 | |
| High | CVE-2025-54897 | Microsoft SharePoint Remote Code Execution Vulnerability | 8.8 | |
| Critical | CVE-2023-21716 | Microsoft Word Remote Code Execution Vulnerability | 9.8 | |
| High | CVE-2025-49712 | Microsoft SharePoint Remote Code Execution Vulnerability | 8.8 | |
| High | CVE-2025-47166 | Microsoft SharePoint Server Remote Code Execution Vulnerability | 8.8 |
News
- October Patch Tuesday roundup: Over 1,400 Microsoft holes to be plugged, including three zero dayscsoonline,
- NCSC-2026-0422 [1.00] [M/H] Kwetsbaarheden verholpen in Microsoft Officencsc-nl,
- Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attackssecurityweek,
- SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wildthehackernews,
- SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCEthehackernews,
- NCSC-2026-0286 [1.01] [H/H] Kwetsbaarheden verholpen in Microsoft Officencsc-nl,