Sharepoint Enterprise Server vulnerabilities

5 known vulnerabilities in Sharepoint Enterprise Server from Microsoft. 4 are rated high or critical, and 4 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 6.5 Medium severity

  Microsoft SharePoint Improper Authentication Exploited

  CVE-2025-49706Jul 8, 2025MicrosoftEPSS 99.9%

  Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

• 8.8 High severity

  Microsoft SharePoint Enterprise Server 2016: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-47172Jun 10, 2025MicrosoftEPSS 1.76%

  Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

• 7.2 High severity

  Microsoft SharePoint Server Code Injection Exploited

  CVE-2023-24955May 9, 2023MicrosoftEPSS 85%

  Microsoft SharePoint Server Remote Code Execution Vulnerability

• 9.8 Critical severity

  Microsoft SharePoint Remote Code Execution Exploited

  CVE-2019-0604Mar 5, 2019MicrosoftEPSS 99.9%

  A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.

• 7.8 High severity

  Microsoft Office Remote Code Execution Exploited

  CVE-2017-11826Oct 13, 2017MicrosoftEPSS 82.2%

  Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer, Word 2007, 2010, 2013 and 2016, Word Automation Services, and Office Online Server allow remote code executio