{"api_version":"v1","generated_at":"2026-10-07T12:45:00+00:00","product":{"cve_count":5,"evidence_gap_note":"This CVE identity is linked to an existing Lifecycle product history.","id":"security:cve-microsoft-sharepoint-server-fcdcbc521ba3","lifecycle_state":"covered","linked_lifecycle_url":"https://lifecycle.blacktree.nl/targets/microsoft-sharepoint-server","name":"SharePoint Server","next_cursor":null,"observations":[{"affected":"Microsoft SharePoint Enterprise Server 2016: 16.0.0 < 16.0.5561.1001; Microsoft SharePoint Server 2019: 16.0.0 < 16.0.10417.20175; Microsoft SharePoint Server Subscription Edition: 16.0.0 < 16.0.19725.20434","affected_versions_present":true,"cve_id":"CVE-2026-56164","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-56164","fixed":"The Cyber Centre recommends that organizations upgrade affected Microsoft SharePoint instances to a fixed version: Affected product Affected versions Fixed versions Microsoft SharePoint Enterprise Server 2016 16.0.0 before 16.0.5561.1001 16.0.5561.1001 Microsoft SharePoint Server 2019 16.0.0 before 16.0.10417.20175 16.0.10417.20175 Microsoft SharePoint Server Subscription Edition 16.0.0 before 16.0.19725.20434 16.0.19725.20434 The Cyber Centre recommends organizations: Identify all on-premises SharePoint Server instances, particularly those exposed to the internet Use or upgrade to supported versions of on-premises Microsoft SharePoint Server Apply the latest security updates from Microsoft to all affected SharePoint Servers including (Subscription Edition, 2019, and 2016) Monitor SharePoint servers for suspicious activity, including unusual requests, web shells, malicious processes, unauthorized access attempts, and machine key theft indicators Harden SharePoint Deployments: Enable Antimalware Scan Interface (AMSI) integration for SharePoint web applications Configure AMSI Request Body Scan Mode to Full Mode where operationally feasible Restrict or eliminate direct Internet exposure of SharePoint servers whenever possible Limit access to SharePoint Central Administration and management interfaces Monitor for Indicators of Compromise: Organizations should closely monitor SharePoint environments for: Unexpected privilege escalation activity Unauthorized authentication attempts Suspicious IIS machine key access Evidence of deserialization attacks or web shell deployment Microsoft Defender and AMSI detections related to SharePoint exploitation activity Important note: Microsoft SharePoint Enterprise Server 2016 Footnote 11 and Server 2019 Footnote 12 are end of life as of July 14, 2026 . Organizations are urged to migrate to a supported version. In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre's Top 10 IT Security Actions with an emphasis on the following topics Footnote 13 . Patch operating systems and applications Harden operating systems and applications Isolate web-facing applications Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal or email contact@cyber.gc.ca .","last_modified":"2026-09-25T18:20:30.063Z","patch_url":"https://www.cyber.gc.ca/en/alerts-advisories/al26-017-critical-vulnerabilities-impacting-microsoft-sharepoint-server-cve-2026-56164-cve-2026-55040-cve-2026-58644","primary_source":"","published":"2026-07-14T17:05:12.313Z"},{"affected":"Microsoft SharePoint Enterprise Server 2016: 16.0.0 < 16.0.5552.1002; Microsoft SharePoint Server 2019: 16.0.0 < 16.0.10417.20128; Microsoft SharePoint Server Subscription Edition: 16.0.0 < 16.0.19725.20280","affected_versions_present":true,"cve_id":"CVE-2026-45659","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-45659","fixed":"The Cyber Centre recommends that organizations upgrade affected Microsoft SharePoint instances to a fixed version: Affected Product Affected Versions Fixed Versions Microsoft SharePoint Enterprise Server 2016 16.0.0 before 16.0.5552.1002 16.0.5552.1002 Microsoft SharePoint Server 2019 16.0.0 before 16.0.10417.20128 16.0.10417.20128 Microsoft SharePoint Server Subscription Edition 16.0.0 before 16.0.19725.20280 16.0.19725.20280 The Cyber Centre recommends organizations: Identify all on-premises SharePoint Server instances, particularly those exposed to the internet. Use or upgrade to supported versions of on-premises Microsoft SharePoint Server. Apply the latest security updates from Microsoft. Important note: Microsoft SharePoint Enterprise Server 2016 Footnote 6 and Server 2019 Footnote 7 will be end of life on July 14, 2026 . Organizations are urged to migrate to a supported version. In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre\u2019s Top 10 IT Security Actions with an emphasis on the following topics Footnote 8 . Patch operating systems and applications Harden operating systems and applications Isolate web-facing applications Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal , or email contact@cyber.gc.ca .","last_modified":"2026-08-11T03:55:31.769Z","patch_url":"https://www.cyber.gc.ca/en/alerts-advisories/al26-015-critical-vulnerability-impacting-microsoft-sharepoint-server-cve-2026-45659","primary_source":"","published":"2026-05-22T22:04:33.517Z"},{"affected":"Microsoft SharePoint Enterprise Server 2016: 16.0.0 < 16.0.5548.1003; Microsoft SharePoint Server 2019: 16.0.0 < 16.0.10417.20114; Microsoft SharePoint Server Subscription Edition: 16.0.0 < 16.0.19725.20210","affected_versions_present":true,"cve_id":"CVE-2026-32201","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-32201","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-25T17:26:11.271Z","patch_url":"https://www.cyber.gc.ca/en/alerts-advisories/microsoft-security-advisory-april-2026-monthly-rollup-av26-352","primary_source":"","published":"2026-04-14T16:58:36.981Z"},{"affected":"Microsoft SharePoint Server 2019: 16.0.0 < 16.0.10399.20005","affected_versions_present":true,"cve_id":"CVE-2023-29357","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-29357","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2025-10-21T23:05:46.015Z","patch_url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29357","primary_source":"","published":"2023-06-13T23:26:02.860Z"},{"affected":"Microsoft SharePoint Enterprise Server 2016: 16.0.0 < 16.0.5395.1000; Microsoft SharePoint Server 2019: 16.0.0 < 16.0.10398.20000; Microsoft SharePoint Server Subscription Edition: 16.0.0 < 16.0.16130.20420","affected_versions_present":true,"cve_id":"CVE-2023-24955","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-24955","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2025-10-21T23:05:47.942Z","patch_url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24955","primary_source":"","published":"2023-05-09T17:03:01.864Z"},{"affected":"SharePoint Server 2016","affected_versions_present":true,"cve_id":"CVE-2018-0869","cve_url":"https://cve.blacktree.nl/cve/CVE-2018-0869","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2024-09-16T22:35:11.143Z","patch_url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0869","primary_source":"","published":"2018-02-15T02:00:00.000Z"}],"source_generated_at":"2026-10-07T06:21:30.017Z","vendor":"Microsoft Corporation"}}