CVE-2026-63512

Microsoft SharePoint Server Tampering Vulnerability

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Enterprise Server 2016 Sharepoint Server Sharepoint Server 2016 and 2 more

CVE-2026-58639

Microsoft SharePoint Server Spoofing Vulnerability

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Enterprise Server 2016 Sharepoint Server Sharepoint Server 2016 and 2 more

CVE-2026-70324

Microsoft SharePoint Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Enterprise Server 2016 Sharepoint Server Sharepoint Server 2016 and 2 more

CVE-2026-63514

Microsoft SharePoint Server Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Enterprise Server 2016 Sharepoint Server Sharepoint Server 2016 and 2 more

CVE-2026-64901

Microsoft SharePoint Server Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Enterprise Server 2016 Sharepoint Server Sharepoint Server 2016 and 2 more

CVE-2022-41061

Microsoft Word Remote Code Execution Vulnerability

Microsoft Word Remote Code Execution Vulnerability

CVSS 3.1 · 7.8 High EPSS 1.3% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office Long Term Servicing Channel and 5 more

CVE-2021-38652

Microsoft SharePoint Server Spoofing Vulnerability

Microsoft SharePoint Server Spoofing Vulnerability

CVSS 3.1 · 7.6 High EPSS 1.3% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Enterprise Server Sharepoint Foundation Sharepoint Foundation 2013 and 1 more

CVE-2021-38651

Microsoft SharePoint Server Spoofing Vulnerability

Microsoft SharePoint Server Spoofing Vulnerability

CVSS 3.1 · 7.6 High EPSS 1.3% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Enterprise Server Sharepoint Foundation Sharepoint Foundation 2013 and 3 more

CVE-2021-36940

Microsoft SharePoint Server Spoofing Vulnerability

Microsoft SharePoint Server Spoofing Vulnerability

CVSS 3.1 · 7.6 High EPSS 4.0% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Enterprise Server Sharepoint Server Sharepoint Server 2013 and 2 more

CVE-2026-55047

Microsoft Office Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Microsoft 365 Apps For Enterprise and 18 more

CVE-2026-55055

Microsoft Word Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Microsoft 365 Apps For Enterprise and 18 more

CVE-2026-55132

Microsoft Word Remote Code Execution Vulnerability

Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Microsoft 365 Apps For Enterprise and 18 more

CVE-2026-56192

Microsoft Office Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Microsoft 365 Apps For Enterprise and 17 more

CVE-2026-55121

Microsoft Office Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Microsoft 365 Apps For Enterprise and 19 more

CVE-2026-55045

Microsoft Office Remote Code Execution Vulnerability

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Microsoft 365 Apps For Enterprise and 17 more

CVE-2026-55035

Microsoft Office Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Microsoft 365 Apps For Enterprise and 17 more

CVE-2026-62826

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Enterprise Server 2016 Sharepoint Server Sharepoint Server 2016 and 2 more

CVE-2026-48560

Microsoft SharePoint Server Spoofing Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Enterprise Server 2016 Sharepoint Server Sharepoint Server 2016 and 2 more

CVE-2026-33113

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Enterprise Server 2016 Sharepoint Server Sharepoint Server 2016 and 2 more

CVE-2026-47639

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Enterprise Server 2016 Sharepoint Server Sharepoint Server 2016 and 2 more