SharePoint Server

Affected and fixed version statements observed in the public BlackTree CVE catalogue. These statements describe vulnerability scope, not publisher support entitlement.

Lifecycle evidence status

This CVE identity is linked to the Lifecycle record SharePoint Server. Use that record for publisher support phases and retirement dates.

A missing support date does not mean the product is supported. CVE publication dates and affected-version ranges must not be interpreted as EOL dates.

CVE-observed version history

CVE	Published	Affected versions	Fixed version information	Publisher evidence
CVE-2026-56164	14 Jul 2026	Microsoft SharePoint Enterprise Server 2016: 16.0.0 < 16.0.5561.1001; Microsoft SharePoint Server 2019: 16.0.0 < 16.0.10417.20175; Microsoft SharePoint Server Subscription Edition: 16.0.0 < 16.0.19725.20434	The Cyber Centre recommends that organizations upgrade affected Microsoft SharePoint instances to a fixed version: Affected product Affected versions Fixed versions Microsoft SharePoint Enterprise Server 2016 16.0.0 before 16.0.5561.1001 16.0.5561.1001 Microsoft SharePoint Server 2019 16.0.0 before 16.0.10417.20175 16.0.10417.20175 Microsoft SharePoint Server Subscription Edition 16.0.0 before 16.0.19725.20434 16.0.19725.20434 The Cyber Centre recommends organizations: Identify all on-premises SharePoint Server instances, particularly those exposed to the internet Use or upgrade to supported versions of on-premises Microsoft SharePoint Server Apply the latest security updates from Microsoft to all affected SharePoint Servers including (Subscription Edition, 2019, and 2016) Monitor SharePoint servers for suspicious activity, including unusual requests, web shells, malicious processes, unauthorized access attempts, and machine key theft indicators Harden SharePoint Deployments: Enable Antimalware Scan Interface (AMSI) integration for SharePoint web applications Configure AMSI Request Body Scan Mode to Full Mode where operationally feasible Restrict or eliminate direct Internet exposure of SharePoint servers whenever possible Limit access to SharePoint Central Administration and management interfaces Monitor for Indicators of Compromise: Organizations should closely monitor SharePoint environments for: Unexpected privilege escalation activity Unauthorized authentication attempts Suspicious IIS machine key access Evidence of deserialization attacks or web shell deployment Microsoft Defender and AMSI detections related to SharePoint exploitation activity Important note: Microsoft SharePoint Enterprise Server 2016 Footnote 11 and Server 2019 Footnote 12 are end of life as of July 14, 2026 . Organizations are urged to migrate to a supported version. In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre's Top 10 IT Security Actions with an emphasis on the following topics Footnote 13 . Patch operating systems and applications Harden operating systems and applications Isolate web-facing applications Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal or email contact@cyber.gc.ca .	Update reference ↗
CVE-2026-45659	22 May 2026	Microsoft SharePoint Enterprise Server 2016: 16.0.0 < 16.0.5552.1002; Microsoft SharePoint Server 2019: 16.0.0 < 16.0.10417.20128; Microsoft SharePoint Server Subscription Edition: 16.0.0 < 16.0.19725.20280	The Cyber Centre recommends that organizations upgrade affected Microsoft SharePoint instances to a fixed version: Affected Product Affected Versions Fixed Versions Microsoft SharePoint Enterprise Server 2016 16.0.0 before 16.0.5552.1002 16.0.5552.1002 Microsoft SharePoint Server 2019 16.0.0 before 16.0.10417.20128 16.0.10417.20128 Microsoft SharePoint Server Subscription Edition 16.0.0 before 16.0.19725.20280 16.0.19725.20280 The Cyber Centre recommends organizations: Identify all on-premises SharePoint Server instances, particularly those exposed to the internet. Use or upgrade to supported versions of on-premises Microsoft SharePoint Server. Apply the latest security updates from Microsoft. Important note: Microsoft SharePoint Enterprise Server 2016 Footnote 6 and Server 2019 Footnote 7 will be end of life on July 14, 2026 . Organizations are urged to migrate to a supported version. In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security Actions with an emphasis on the following topics Footnote 8 . Patch operating systems and applications Harden operating systems and applications Isolate web-facing applications Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal , or email contact@cyber.gc.ca .	Update reference ↗
CVE-2026-32201	14 Apr 2026	Microsoft SharePoint Enterprise Server 2016: 16.0.0 < 16.0.5548.1003; Microsoft SharePoint Server 2019: 16.0.0 < 16.0.10417.20114; Microsoft SharePoint Server Subscription Edition: 16.0.0 < 16.0.19725.20210	No fixed version is explicitly recorded in the structured CVE data.	Update reference ↗
CVE-2023-29357	13 Jun 2023	Microsoft SharePoint Server 2019: 16.0.0 < 16.0.10399.20005	An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.	Update reference ↗
CVE-2023-24955	9 May 2023	Microsoft SharePoint Enterprise Server 2016: 16.0.0 < 16.0.5395.1000; Microsoft SharePoint Server 2019: 16.0.0 < 16.0.10398.20000; Microsoft SharePoint Server Subscription Edition: 16.0.0 < 16.0.16130.20420	An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.	Update reference ↗
CVE-2018-0869	15 Feb 2018	SharePoint Server 2016	An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.	Update reference ↗

How this record is maintained

The CVE inventory is reconciled automatically from cve.blacktree.nl. Exact identity matches link to existing Lifecycle product or package histories. Unmatched products stay in a prioritised publisher-source research queue, and Lifecycle marks the date gap instead of inferring a support boundary from vulnerability data.