CVE-2026-32201

What it actually does

This is a network-exploitable improper input validation flaw in Microsoft SharePoint Server that allows an unauthenticated attacker to spoof trusted input or identity-related request context. Because the issue is reachable without credentials or user interaction, an attacker can send crafted requests directly to a SharePoint endpoint. The expected technical impact is limited confidentiality and integrity compromise: misleading or unauthorized actions may be accepted as legitimate, content or workflow context may be spoofed, or security decisions that rely on unvalidated request data may be bypassed. The CVSS vector indicates no direct availability impact and does not indicate remote code execution.

Why it matters to the business

Successful exploitation can undermine trust in SharePoint-hosted collaboration, documents, workflows, or user-facing content by allowing an outside attacker to make fraudulent network requests appear legitimate. For organizations using SharePoint for business-critical document management, portals, or internal collaboration, this can result in data exposure, unauthorized content changes, phishing support from trusted infrastructure, incident response costs, and loss of confidence in affected sites. This vulnerability is listed in CISA KEV with known exploitation in the wild and a remediation due date of 2026-04-28, so internet-accessible or partner-accessible SharePoint deployments should be treated as urgent even though the CVSS score is moderate. EPSS is elevated, indicating meaningful likelihood of exploitation activity.

How an attack unfolds

An attacker first identifies a reachable Microsoft SharePoint Server instance, typically by scanning for SharePoint web interfaces, Microsoft-specific HTTP headers, login pages, or known SharePoint paths. The attacker then sends crafted unauthenticated network requests that abuse insufficient validation of attacker-controlled input. Depending on the vulnerable code path, this may involve malformed or spoofed request metadata, URL parameters, routing values, host/origin-style headers, or other values that SharePoint improperly trusts. If accepted, the forged input can cause SharePoint to treat the request or resulting content as though it came from a different origin, context, or trusted source. The attacker then uses that spoofed context to access limited information, alter low-impact content or workflow state, mislead users, or support broader social engineering and credential-theft activity. Known exploitation has been observed in the wild, including reporting associated with BlueHammer, so defenders should assume exposed vulnerable systems may have been probed or targeted.

How to fix it

Apply the Microsoft security update for the affected SharePoint Server version that addresses CVE-2026-32201. Microsoft has not provided fixed version details in the supplied data, so administrators should consult the official Microsoft Security Update Guide and install the applicable cumulative/security update for every supported SharePoint Server farm and role. Prioritize internet-facing, extranet, partner-facing, and high-value collaboration farms. If immediate patching is not possible, reduce exposure by restricting SharePoint access to trusted networks or VPN, placing the service behind a reverse proxy or WAF with strict request normalization, blocking suspicious spoofing headers and malformed requests, disabling anonymous access where not required, enforcing strong authentication, and monitoring for exploitation attempts. Mitigations should be treated as temporary; patching is the required remediation for KEV compliance by 2026-04-28.

How to confirm the fix worked

Confirm all SharePoint Server hosts and farm roles have the applicable Microsoft security update installed by comparing installed build numbers and KB levels against the Microsoft Security Update Guide for this vulnerability. Validate that every server in the farm, including web front ends and application servers, is patched consistently. Run authenticated vulnerability scanning where supported and confirm the finding is no longer reported. Review reverse proxy, WAF, and IIS behavior to ensure malformed or spoofed unauthenticated requests are rejected or normalized. Where safe and authorized, perform a controlled negative test using benign spoofed request metadata to verify the vulnerable behavior is not accepted. Also confirm SharePoint services, search, workflow, and user-facing sites function normally after patching.

Typical attack path

1. Discover SharePoint Server instances through internet scanning, search engines, DNS names, or exposed collaboration portals.
2. Fingerprint the deployment to confirm it is Microsoft SharePoint Server and infer whether it may be unpatched.
3. Send unauthenticated crafted HTTP requests containing spoofed or malformed input that reaches the vulnerable validation logic.
4. Observe whether SharePoint accepts, reflects, redirects, logs, or acts on the spoofed input in a way that indicates successful exploitation.
5. Use the spoofed trust context to cause limited unauthorized disclosure, content manipulation, misleading links, or workflow/user deception.
6. Chain the spoofing result with phishing, credential harvesting, session abuse, or additional SharePoint vulnerabilities where possible.

How to detect it

Investigate whether exploitation already occurred by reviewing IIS W3C logs for SharePoint web applications, SharePoint ULS logs, reverse proxy and WAF logs, Windows Security and Application event logs, authentication provider logs, and SharePoint audit records. Focus on unauthenticated requests to SharePoint endpoints that include malformed, duplicated, inconsistent, or spoofed request metadata, especially Host, Origin, Referer, X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Proto, Forwarded, X-Original-URL, X-Rewrite-URL, and similar proxy or routing headers. Look for unusual sequences where unauthenticated requests receive successful 200 or redirect 302 responses instead of expected 401/403 responses, followed by content access, workflow activity, page edits, or user interaction. Review for newly created or modified pages, unexpected links, phishing-like content, anomalous file changes, changes to trusted locations or web settings, and login spikes shortly after suspicious SharePoint requests. Because exploitation is reported in the wild and associated reporting includes BlueHammer, correlate suspicious SharePoint activity with threat-intelligence hits, known malicious source IPs from organizational feeds, and WAF detections for spoofed header abuse. Absence of a public exploit-specific string means detection should be behavior-based rather than relying on a single signature.

• C:\inetpub\logs\LogFiles\
• C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\LOGS\
• X-Forwarded-For:
• X-Forwarded-Host:
• X-Forwarded-Proto:
• Forwarded:
• X-Original-URL:
• X-Rewrite-URL:
• Origin:
• Referer:
• Host:

What your security team should do

• Treat this as a high-priority remediation item because it is in CISA KEV, has active exploitation in the wild, and affects externally reachable SharePoint collaboration infrastructure.
• Inventory all Microsoft SharePoint Server instances, including non-production, disaster recovery, extranet, and legacy farms.
• Patch affected SharePoint Server farms using the applicable Microsoft security updates and verify build levels across every server in each farm.
• Prioritize systems exposed to the internet, accessible by partners, or hosting sensitive business documents and workflows.
• If patching cannot be completed immediately, restrict network access, require VPN or trusted proxy access, disable unnecessary anonymous access, and apply WAF/reverse-proxy rules for malformed or spoofed request metadata.
• Review IIS, SharePoint ULS, WAF, reverse proxy, authentication, and Windows event logs for exploitation attempts since at least the publication date, 2026-04-14.
• Hunt for activity associated with spoofed Host, Origin, Referer, X-Forwarded-* headers, unusual unauthenticated 200/302 responses, and unexpected SharePoint content or workflow changes.
• Increase monitoring of SharePoint for credential theft, phishing pages, unauthorized file changes, and follow-on authentication anomalies.
• Document remediation evidence for KEV tracking before the 2026-04-28 due date.