Microsoft has released urgent security updates to fix an actively exploited SharePoint Server flaw as part of its April Patch Tuesday rollout.
Quick Summary – TLDR:
- Microsoft patched over 160 vulnerabilities, including one actively exploited zero day.
- CVE-2026-32201 impacts SharePoint Server and allows spoofing attacks.
- CISA has added the flaw to its KEV catalog, requiring urgent action.
- Organizations are strongly advised to update immediately to prevent attacks.
What Happened?
Microsoft addressed a major set of vulnerabilities in its April Patch Tuesday update, including a SharePoint Server zero-day that is already being exploited in the wild. The flaw allows attackers to spoof trusted content and access sensitive data without authentication.
🛡️ We added Microsoft Office remote code execution vulnerability CVE-2009-0238 & Microsoft SharePoint server improper input validation vulnerability CVE-2026-32201 to our Known Exploited Vulnerabilities Catalog. Visit https://t.co/myxOwap1Tf for more information. pic.twitter.com/U1Ff9SUWOz
— CISA Cyber (@CISACyber) April 14, 2026
Microsoft Fixes SharePoint Zero Day Under Active Exploitation
Microsoft has rolled out security updates to fix CVE-2026-32201, a SharePoint Server spoofing vulnerability that has been actively exploited by threat actors. The company confirmed that attackers can exploit the flaw remotely without requiring authentication or user interaction, making it especially dangerous for enterprise environments.
The vulnerability stems from improper input validation within the Microsoft Office SharePoint architecture. This weakness allows attackers to manipulate how data is presented, potentially tricking users into trusting malicious content.
Despite its CVSS score of 6.5, which is considered moderate, the fact that it is already being exploited raises its urgency significantly.
What Attackers Can Do?
If successfully exploited, the flaw can lead to:
- Unauthorized access to sensitive data.
- Modification of disclosed information.
- Spoofing of trusted interfaces or content.
However, Microsoft noted that attackers cannot disrupt system availability, limiting the scope of damage to confidentiality and integrity.
Security experts warn that spoofing vulnerabilities like this can act as an entry point for more complex attacks, especially when combined with other weaknesses.
Massive Patch Tuesday Release
The SharePoint flaw was part of a broader April 2026 Patch Tuesday update, where Microsoft addressed over 160 vulnerabilities across its ecosystem.
Breakdown of the vulnerabilities includes:
- 157 Important severity issues.
- 8 Critical vulnerabilities.
- Major categories include privilege escalation, remote code execution, and information disclosure.
This update marks one of the largest Patch Tuesday releases in recent history, continuing a trend of high vulnerability volumes in 2026.
CISA Adds Flaw to Known Exploited List
The Cybersecurity and Infrastructure Security Agency CISA has added CVE-2026-32201 to its Known Exploited Vulnerabilities catalog, highlighting its real world threat.
Federal agencies have been given a deadline of April 28, 2026 to apply the necessary patches, reinforcing the urgency of remediation.
Interestingly, it remains unclear who is behind the attacks or how widely the vulnerability is being exploited. Experts suggest it could be used alongside other vulnerabilities to increase impact.
Other Notable Vulnerabilities
Alongside the SharePoint issue, Microsoft also fixed several other important flaws:
- A Microsoft Defender privilege escalation vulnerability CVE-2026-33825 that was publicly disclosed.
- A critical remote code execution flaw CVE-2026-33824 affecting Windows IKE services with a high severity score.
Several other Windows components were also flagged as more likely to be exploited, including Active Directory, Remote Desktop, and BitLocker.
What Organizations Should Do?
Microsoft has released patches for affected versions, including:
- SharePoint Server Subscription Edition
- SharePoint Server 2019
- SharePoint Enterprise Server 2016
Organizations running these systems should apply updates immediately to reduce exposure.
Delaying patch deployment could leave systems vulnerable to ongoing attacks, especially given the active exploitation status of this flaw.
SQ Magazine’s Takeaway
I think this is one of those updates that companies simply cannot afford to ignore. Even though the severity score looks moderate on paper, the real world exploitation changes everything. When attackers are already using a flaw, every hour of delay increases risk.
What stands out to me is how easily this vulnerability can be exploited without authentication. That alone makes it a serious concern for any organization running SharePoint. If you are managing enterprise systems, this should be at the top of your priority list today.
