CVE-2026-32201

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-32201 6.5

Microsoft · SharePoint Server · Added 2026-04-14 · Published 2026-04-14

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityMicrosoft SharePoint Server Improper Input Validation Vulnerability

VendorMicrosoft

ProductSharePoint Server

Date added2026-04-14

Due date2026-04-28

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-20

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Descriptions

KEV: Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network.

NVD: Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impactpartial

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days

Non-public timeline14 days

Forensic (public)Not required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-26 23:41 UTC

Wall time0.3s

Searches4

Component defaultyes

Sources https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201
https://nvd.nist.gov/vuln/detail/CVE-2026-32201
https://github.com/B1tBit/CVE-2026-32201-exploit
https://www.tenable.com/cve/CVE-2026-32201
https://blog.talosintelligence.com/microsoft-patch-tuesday-april-2026/
https://www.cybersecuritydive.com/news/medium-severity-flaw-microsoft-sharepoint-exploitation/817559/
https://www.zerosday.com/post/cves/cve-2026-32201-sharepoint-server-lab
https://www.foresiet.com/blog/sharepoint-server-spoofing-vulnerability-cve-2026-32201/
https://www.penligent.ai/hackinglabs/cve-2026-32201-the-sharepoint-bug-you-cannot-triage-by-cvss-alone/
https://fiboo.com.tr/en/knowledge-center/cve-2026-32201-sharepoint-spoofing-vulnerability-enterprise-patching-guide

QC notes

warn component_extraction: Component 'SharePoint Server Notification System (layouts/15/notify.aspx endpoint with sender_override parameter)' matches or contains product name 'SharePoint Server' — no specific component identified

Hunting hypothesis agent

Hunt IIS logs for unauthenticated POST requests to /_layouts/15/notify.aspx with sender_override and recipient parameters from external IPs, correlated with 200 responses containing spoofed sender addresses.

Research details

ComponentSharePoint Server Notification System (layouts/15/notify.aspx endpoint with sender_override parameter)

PreconditionsNetwork access to an exposed SharePoint Server instance running a vulnerable version (SharePoint Server 2016 Enterprise, 2019, or Subscription Edition < 16.0.19725.20210); the notify.aspx notification endpoint must be accessible; no authentication required (CVSS PR:N); target must be an on-premises SharePoint deployment (SharePoint Online not affected). agent

DeliveryUnauthenticated HTTP POST request to the SharePoint notify.aspx endpoint with a crafted sender_override parameter that bypasses input validation, allowing spoofed email notifications and reflected XSS injection into the SharePoint site context.

Public PoCyes

PoC URLs https://github.com/B1tBit/CVE-2026-32201-exploit Third-party repos; verify before use.

Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201

Exploit notesCVSS attack complexity: LOW. Public PoC exploit available in Python on GitHub (B1tBit/CVE-2026-32201-exploit). Exploitation was detected in the wild prior to April 14, 2026 Patch Tuesday. CISA KEV added April 14, 2026.

SummaryCVE-2026-32201 is an improper input validation vulnerability in the SharePoint Server notification system (notify.aspx endpoint). An unauthenticated attacker can send crafted HTTP POST requests with a manipulated sender_override parameter to spoof notifications and inject reflected XSS payloads, potentially leading to credential harvesting or data disclosure. Detection should focus on monitoring IIS and SharePoint ULS logs for anomalous POST requests to /_layouts/15/notify.aspx with unusual parameter values and monitoring for w3wp.exe spawning child processes.

Tia coverage

First reported2026-07-17

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

microsoft-sharepoint-exploitation-fourth-kev-entry-tenable-confi warlock-ransomware-breach-sharepoint-in-water-telecom-operator-a

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.