SharePoint in the Crosshairs: What CVE-2026-32201 Means for Enterprise Security

## Executive summary CVE-2026-32201 is a spoofing vulnerability in on-premises Microsoft SharePoint (SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition) that permits unauthenticated remote attackers to craft requests that cause SharePoint to display or return content appearing to originate from trusted internal sources; Microsoft released patches on April 14, 2026 and the flaw was confirmed as actively exploited and added to CISA’s KEV catalog, with thousands of internet-facing servers observed unpatched—organisations are advised to patch immediately, restrict external access (VPN/ZTNA), deploy WAFs, enable enhanced logging, enforce least privilege, and audit for pre-patch exploitation.