CVE-2026-47640

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019

CVE-2026-45483

Microsoft Office Project Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Project Server allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019 and 1 more

CVE-2024-49062

Microsoft SharePoint Information Disclosure Vulnerability

Microsoft SharePoint Information Disclosure Vulnerability

CVSS 3.1 · 6.5 Medium EPSS 3.2% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019

CVE-2024-49070

Microsoft SharePoint Remote Code Execution Vulnerability

Microsoft SharePoint Remote Code Execution Vulnerability

CVSS 3.1 · 7.4 High EPSS 2.3% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019

CVE-2024-49064

Microsoft SharePoint Information Disclosure Vulnerability

Microsoft SharePoint Information Disclosure Vulnerability

CVSS 3.1 · 6.5 Medium EPSS 2.5% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019

CVE-2024-43503

Microsoft SharePoint Elevation of Privilege Vulnerability

Microsoft SharePoint Elevation of Privilege Vulnerability

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019

CVE-2026-40367

Microsoft Word Remote Code Execution Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office 2019 and 10 more

CVE-2026-40365

Microsoft SharePoint Server Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019

CVE-2026-32201

Microsoft SharePoint Server Spoofing Vulnerability

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 6.5 Medium EPSS 44.0% KEV · Listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019 and 1 more

CVE-2026-33110

Microsoft SharePoint Server Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019 and 1 more

CVE-2026-33112

Microsoft SharePoint Server Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 31.1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019 and 1 more

CVE-2026-35439

Microsoft SharePoint Server Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019

CVE-2026-40368

Microsoft SharePoint Server Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8 High EPSS 1.8% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019 and 1 more

CVE-2026-40357

Microsoft SharePoint Server Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019

CVE-2026-20945

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 4.6 Medium EPSS 19.8% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Enterprise Server 2016 Sharepoint Server Sharepoint Server 2016 and 2 more

CVE-2025-62562

Microsoft Outlook Remote Code Execution Vulnerability

Use after free in Microsoft Office Outlook allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office 2019 and 10 more

CVE-2025-62555

Microsoft Word Remote Code Execution Vulnerability

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office 2019 and 10 more

CVE-2025-62558

Microsoft Word Remote Code Execution Vulnerability

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office 2019 and 10 more

CVE-2025-62559

Microsoft Word Remote Code Execution Vulnerability

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office 2019 and 10 more

CVE-2026-20948

Microsoft Word Remote Code Execution Vulnerability

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Office Office 2019 and 10 more