Microsoft Patches Actively Exploited SharePoint Zero-Day in Massive April Update
CVE-2026-32201 allows unauthenticated spoofing on SharePoint Server. CISA added it to KEV immediately. Third SharePoint zero-day in under a year — ToolShell echoes loom large.
Microsoft's April 2026 Patch Tuesday — the second-largest in the company's history at over 160 CVEs — fixes an actively exploited SharePoint Server spoofing vulnerability that CISA immediately added to its Known Exploited Vulnerabilities catalog. The flaw, tracked as CVE-2026-32201, marks the third SharePoint zero-day exploited in the wild in under a year.
What Makes CVE-2026-32201 Dangerous Despite a Moderate Score
CVE-2026-32201 carries a CVSS score of 6.5 (rated "Important"), but that number understates the real-world risk. The vulnerability stems from improper input validation (CWE-20) in SharePoint Server and allows unauthenticated attackers to perform spoofing over the network with no user interaction required.
Zero Day Initiative analysts note that SharePoint spoofing bugs frequently manifest as cross-site scripting (XSS) flaws in practice, enabling credential harvesting, session hijacking, and user impersonation within trusted enterprise environments.
Action1 co-founder Mike Walters warned the flaw "can enable phishing attacks, unauthorized data manipulation, or social engineering campaigns that lead to further compromise." All on-premises versions are affected: SharePoint Server 2016, 2019, and Subscription Edition. SharePoint Online in Microsoft 365 is not impacted. CISA has set an April 28, 2026 remediation deadline for federal agencies.
The ToolShell Shadow Looms Over SharePoint Security
Tenable's Satnam Narang drew a direct line to the devastating ToolShell exploit chain from July 2025, when Chinese APT groups and ransomware operators compromised 400+ organizations — including U.S. government agencies — through a strikingly similar SharePoint spoofing-to-RCE chain. That campaign, attributed to Linen Typhoon, Violet Typhoon, and Storm-2603, exploited the same vulnerability class (CWE-20 input validation bypass) and triggered emergency CISA alerts, Microsoft out-of-band patches, and reforms to the MAPP partner program.
Combined with CVE-2026-20963 (CVSS 9.8), an unauthenticated deserialization RCE patched in January 2026 and added to CISA's KEV in March, SharePoint now accounts for nine entries in the KEV catalog. The April update also patches a companion spoofing flaw, CVE-2026-20945 (CVSS 4.6), in the same code area.
What Enterprise Security Teams Should Do Now
Security teams should treat this as a Priority 1 patch despite the moderate CVSS score — active exploitation changes the calculus entirely.
- Apply KB5002853 (Subscription Edition), KB5002854 (2019), or KB5002861 (2016) immediately
- Enable AMSI integration on all SharePoint web applications
- Rotate ASP.NET machine keys before and after patching — stolen keys allow persistent access even post-patch
- Deploy WAF rules blocking suspicious requests to SharePoint layout endpoints
For teams unable to patch immediately, CISA recommends disconnecting internet-facing SharePoint servers until updates are applied. Monitor IIS logs for anomalous POST requests, unexpected Referer headers, and suspicious child processes spawned by w3wp.exe.
SharePoint 2016 reaches end of extended support on July 14, 2026 — organizations still running it face a rapidly closing window for security coverage.
The Bigger Picture
On-premises SharePoint remains one of the most actively targeted enterprise attack surfaces. Organizations should accelerate migration planning to SharePoint Online while hardening remaining on-premises deployments with network segmentation, EDR coverage, and comprehensive logging aligned to CISA's post-ToolShell guidance.
