More than 1,300 internet-exposed Microsoft SharePoint servers remain unpatched against a spoofing flaw previously exploited as a zero-day.
“Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network,” Microsoft said in its advisory.
SharePoint servers still exposed
The vulnerability, tracked as CVE-2026-32201, affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. These platforms are widely used for enterprise document management and collaboration.
Because these systems host sensitive data and support daily operations, exploitation could lead to unauthorized access, data changes, and broader business impact.
Despite Microsoft releasing patches during April 2026 Patch Tuesday, exposure remains high, with more than 1,300 internet-facing SharePoint systems still unpatched, according to Shadowserver.
CVE-2026-32201
The flaw stems from an improper input validation weakness that enables network spoofing, allowing attackers to manipulate how SharePoint processes inputs, thereby impersonating trusted sources or altering data flows.
Because it requires low attack complexity and no user interaction, it is easier to exploit at scale, especially in internet-exposed or poorly secured environments.
Microsoft has confirmed that CVE-2026-32201 was exploited in the wild as a zero-day prior to patch availability. However, it has not disclosed specific details about the attack methods or attributed the activity to a specific threat actor.
How to mitigate SharePoint risk
Because the flaw has been exploited and impacts externally exposed systems, organizations should take a broader approach beyond patching.
Security teams should also focus on reducing exposure, strengthening access controls, and improving visibility into potential misuse.
- Apply the latest patch for all affected SharePoint versions and validate deployments before production rollout.
- Restrict or eliminate internet exposure by placing SharePoint servers behind VPNs, reverse proxies, or access controls such as IP allowlisting.
- Rotate credentials where appropriate and review permissions to ensure least privilege across SharePoint environments.
- Invalidate or review sensitive data and monitor for unauthorized changes that could indicate spoofing or tampering.
- Strengthen monitoring and detection by enabling detailed logging, forwarding logs to a SIEM, and hunting for unusual access or modification patterns.
- Implement defense-in-depth controls such as network segmentation, WAF protections, and hardened SharePoint configurations to reduce the attack surface.
- Test incident response plans, including running attack simulations for spoofing and unauthorized access scenarios.
This incident reflects a broader trend of attackers focusing on widely used enterprise platforms, particularly those that are slower to receive timely updates. Collaboration tools like SharePoint remain common targets because they store sensitive business data and are often exposed to external networks.
At the same time, advances in AI and automation are helping attackers identify and exploit vulnerabilities more quickly, shortening the window between patch release and active exploitation.
Editor’s note: This article originally appeared on our sister publication, eSecurityPlanet.