← Search results
CVE-LINKED INVENTORY11 SECURITY RECORDS
Microsoft Corporation
SharePoint
Affected and fixed version statements observed in the public BlackTree CVE catalogue. These statements describe vulnerability scope, not publisher support entitlement.
This CVE identity is linked to the Lifecycle record Microsoft SharePoint. Use that record for publisher support phases and retirement dates.
A missing support date does not mean the product is supported. CVE publication dates and affected-version ranges must not be interpreted as EOL dates.
CVE-observed version history
| CVE | Published | Affected versions | Fixed version information | Publisher evidence |
|---|---|---|---|---|
| CVE-2026-65660 | 11 Aug 2026 | Microsoft SharePoint Enterprise Server 2016: 16.0.0 < 16.0.5565.1001; Microsoft SharePoint Server 2019: 16.0.0 < 16.0.10417.20198; Microsoft SharePoint Server Subscription Edition: 16.0.0 < 16.0.19725.20522 | 16.0.5565.1001:Security Update:https://support.microsoft.com/help/5002905 | Update reference ↗ |
| CVE-2026-55040 | 14 Jul 2026 | Microsoft SharePoint Enterprise Server 2016: 16.0.0 < 16.0.5561.1001; Microsoft SharePoint Server 2019: 16.0.0 < 16.0.10417.20175; Microsoft SharePoint Server Subscription Edition: 16.0.0 < 16.0.19725.20434 | The Cyber Centre recommends that organizations upgrade affected Microsoft SharePoint instances to a fixed version: Affected product Affected versions Fixed versions Microsoft SharePoint Enterprise Server 2016 16.0.0 before 16.0.5561.1001 16.0.5561.1001 Microsoft SharePoint Server 2019 16.0.0 before 16.0.10417.20175 16.0.10417.20175 Microsoft SharePoint Server Subscription Edition 16.0.0 before 16.0.19725.20434 16.0.19725.20434 The Cyber Centre recommends organizations: Identify all on-premises SharePoint Server instances, particularly those exposed to the internet Use or upgrade to supported versions of on-premises Microsoft SharePoint Server Apply the latest security updates from Microsoft to all affected SharePoint Servers including (Subscription Edition, 2019, and 2016) Monitor SharePoint servers for suspicious activity, including unusual requests, web shells, malicious processes, unauthorized access attempts, and machine key theft indicators Harden SharePoint Deployments: Enable Antimalware Scan Interface (AMSI) integration for SharePoint web applications Configure AMSI Request Body Scan Mode to Full Mode where operationally feasible Restrict or eliminate direct Internet exposure of SharePoint servers whenever possible Limit access to SharePoint Central Administration and management interfaces Monitor for Indicators of Compromise: Organizations should closely monitor SharePoint environments for: Unexpected privilege escalation activity Unauthorized authentication attempts Suspicious IIS machine key access Evidence of deserialization attacks or web shell deployment Microsoft Defender and AMSI detections related to SharePoint exploitation activity Important note: Microsoft SharePoint Enterprise Server 2016 Footnote 11 and Server 2019 Footnote 12 are end of life as of July 14, 2026 . Organizations are urged to migrate to a supported version. In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre's Top 10 IT Security Actions with an emphasis on the following topics Footnote 13 . Patch operating systems and applications Harden operating systems and applications Isolate web-facing applications Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal or email contact@cyber.gc.ca . | Update reference ↗ |
| CVE-2026-58644 | 14 Jul 2026 | Microsoft SharePoint Enterprise Server 2016: 16.0.0 < 16.0.5556.1005; Microsoft SharePoint Server 2019: 16.0.0 < 16.0.10417.20153; Microsoft SharePoint Server Subscription Edition: 16.0.0 < 16.0.19725.20384 | The Cyber Centre recommends that organizations upgrade affected Microsoft SharePoint instances to a fixed version: Affected product Affected versions Fixed versions Microsoft SharePoint Enterprise Server 2016 16.0.0 before 16.0.5561.1001 16.0.5561.1001 Microsoft SharePoint Server 2019 16.0.0 before 16.0.10417.20175 16.0.10417.20175 Microsoft SharePoint Server Subscription Edition 16.0.0 before 16.0.19725.20434 16.0.19725.20434 The Cyber Centre recommends organizations: Identify all on-premises SharePoint Server instances, particularly those exposed to the internet Use or upgrade to supported versions of on-premises Microsoft SharePoint Server Apply the latest security updates from Microsoft to all affected SharePoint Servers including (Subscription Edition, 2019, and 2016) Monitor SharePoint servers for suspicious activity, including unusual requests, web shells, malicious processes, unauthorized access attempts, and machine key theft indicators Harden SharePoint Deployments: Enable Antimalware Scan Interface (AMSI) integration for SharePoint web applications Configure AMSI Request Body Scan Mode to Full Mode where operationally feasible Restrict or eliminate direct Internet exposure of SharePoint servers whenever possible Limit access to SharePoint Central Administration and management interfaces Monitor for Indicators of Compromise: Organizations should closely monitor SharePoint environments for: Unexpected privilege escalation activity Unauthorized authentication attempts Suspicious IIS machine key access Evidence of deserialization attacks or web shell deployment Microsoft Defender and AMSI detections related to SharePoint exploitation activity Important note: Microsoft SharePoint Enterprise Server 2016 Footnote 11 and Server 2019 Footnote 12 are end of life as of July 14, 2026 . Organizations are urged to migrate to a supported version. In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre's Top 10 IT Security Actions with an emphasis on the following topics Footnote 13 . Patch operating systems and applications Harden operating systems and applications Isolate web-facing applications Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal or email contact@cyber.gc.ca . | Update reference ↗ |
| CVE-2026-50522 | 14 Jul 2026 | Microsoft SharePoint Enterprise Server 2016: 16.0.0 < 16.0.5561.1001; Microsoft SharePoint Server 2019: 16.0.0 < 16.0.10417.20175; Microsoft SharePoint Server Subscription Edition: 16.0.0 < 16.0.19725.20434 | An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release. | Update reference ↗ |
| CVE-2026-20963 | 13 Jan 2026 | Microsoft SharePoint Enterprise Server 2016: 16.0.0 < 16.0.5535.1001; Microsoft SharePoint Server 2019: 16.0.0 < 16.0.10417.20083; Microsoft SharePoint Server Subscription Edition: 16.0.0 < 16.0.19127.20442 | The Cyber Centre recommends that organizations upgrade affected Microsoft SharePoint instances to a fixed version: Affected product Affected versions Fixed versions Microsoft SharePoint Enterprise Server 2016 16.0.0 before 16.0.5535.1001 16.0.5535.1001 Microsoft SharePoint Server 2019 16.0.0 before 16.0.10417.20083 16.0.10417.20083 Microsoft SharePoint Server Subscription Edition 16.0.0 before 16.0.19127.20442 16.0.19127.20442 Open-source reporting indicates that other legacy versions are affected by this vulnerability but are now considered end of support/life and should be decommissioned or upgraded. The Cyber Centre recommends organizations to: Identify all on-premises SharePoint Server instances, particularly those exposed to the internet. Use or upgrade to supported versions of on-premises Microsoft SharePoint Server. Apply the latest security updates from Microsoft. In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre's Top 10 IT Security Actions with an emphasis on the following topics Footnote 6 . Patch operating systems and applications Harden operating systems and applications Isolate web-facing applications Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal or email contact@cyber.gc.ca . | Update reference ↗ |
| CVE-2025-53770 | 20 Jul 2025 | Microsoft SharePoint Enterprise Server 2016: 16.0.0 < 16.0.5513.1001; Microsoft SharePoint Server 2019: 16.0.0 < 16.0.10417.20037; Microsoft SharePoint Server Subscription Edition: 16.0.0 < 16.0.18526.20508 | No fixed version is explicitly recorded in the structured CVE data. | Update reference ↗ |
| CVE-2025-49706 | 8 Jul 2025 | Microsoft SharePoint Enterprise Server 2016: 16.0.0 < 16.0.5508.1000; Microsoft SharePoint Server 2019: 16.0.0 < 16.0.10417.20027; Microsoft SharePoint Server Subscription Edition: 16.0.0 < 16.0.18526.20424 | No fixed version is explicitly recorded in the structured CVE data. | Update reference ↗ |
| CVE-2025-49704 | 8 Jul 2025 | Microsoft SharePoint Enterprise Server 2016: 16.0.0 < 16.0.5508.1000; Microsoft SharePoint Server 2019: 16.0.0 < 16.0.10417.20027 | No fixed version is explicitly recorded in the structured CVE data. | Update reference ↗ |
| CVE-2024-38094 | 9 Jul 2024 | Microsoft SharePoint Enterprise Server 2016: 16.0.0 < 16.0.5456.1000; Microsoft SharePoint Server 2019: 16.0.0 < 16.0.10412.20001; Microsoft SharePoint Server Subscription Edition: 16.0.0 < 16.0.17328.20424 | An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release. | Update reference ↗ |
| CVE-2019-0604 | 6 Mar 2019 | Microsoft SharePoint Server: 2010 Service Pack 2, 2019; Microsoft SharePoint Foundation: 2013 Service Pack 1; Microsoft SharePoint Enterprise Server: 2016 | An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release. | Update reference ↗ |
| CVE-2017-0107 | 17 Mar 2017 | SharePoint Server | An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release. | Update reference ↗ |
How this record is maintained
The CVE inventory is reconciled automatically from cve.blacktree.nl. Exact identity matches link to existing Lifecycle product or package histories. Unmatched products stay in a prioritised publisher-source research queue, and Lifecycle marks the date gap instead of inferring a support boundary from vulnerability data.