Microsoft has released security updates to address an actively exploited spoofing vulnerability in Microsoft SharePoint Server, tracked as CVE-2026-32201.
Vulnerability Overview
Assigned a CVSS score of 6.5, this zero-day vulnerability stems from improper input validation. It allows unauthenticated remote attackers to perform spoofing, potentially tricking users into revealing sensitive information or executing unauthorized actions on behalf of the attacker.
How to check if you’re affected
- Identify SharePoint Instances: Determine if your organization runs on-premises or hybrid instances of Microsoft SharePoint Server.
- Apply April 2026 Updates: Verify that the Microsoft April 2026 security updates are applied across all your SharePoint servers.
- Check Logs for Spoofing Attempts: Review your web application firewall (WAF) and SharePoint access logs for abnormal requests or suspicious redirection attempts.