SharePoint 16.0 vulnerabilities
14 advisories affect Microsoft SharePoint 16.0, 14 already exploited by attackers. Latest: September 25, 2026.
Running SharePoint 16.0 devices? Get an email when a new vulnerability comes out. Free, unsubscribe in one click.
Turn on SharePoint 16.0 alerts
Turn on SharePoint 16.0 alerts
| Vulnerability | Severity | Affected versions |
|---|---|---|
| Microsoft SharePoint Code Injection Vulnerability CVE-2026-65660 · September 25, 2026 | High 8.8 Exploited | from 16.0.0 to 16.0.5565.1001 (excluded); from 16.0.0 to 16.0.10417.20198 (excluded); from 16.0.0 to 16.0.19725.20522 (excluded) Fixed in 16.0.5565.1001, 16.0.10417.20198, 16.0.19725.20522 |
| Microsoft SharePoint Weak Authentication Vulnerability CVE-2026-55040 · August 18, 2026 | Critical 9.1 Exploited | from 16.0.0 to 16.0.5561.1001 (excluded); from 16.0.0 to 16.0.10417.20175 (excluded); from 16.0.0 to 16.0.19725.20434 (excluded) Fixed in 16.0.5561.1001, 16.0.10417.20175, 16.0.19725.20434 |
| Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CVE-2026-50522 · July 22, 2026 | Critical 9.8 Exploited | from 16.0.0 to 16.0.5561.1001 (excluded); from 16.0.0 to 16.0.10417.20175 (excluded); from 16.0.0 to 16.0.19725.20434 (excluded) Fixed in 16.0.5561.1001, 16.0.10417.20175, 16.0.19725.20434 |
| Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CVE-2026-58644 · July 16, 2026 | Critical 9.8 Exploited | from 16.0.0 to 16.0.5556.1005 (excluded); from 16.0.0 to 16.0.10417.20153 (excluded); from 16.0.0 to 16.0.19725.20384 (excluded) Fixed in 16.0.5556.1005, 16.0.10417.20153, 16.0.19725.20384 |
| Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability CVE-2026-56164 · July 14, 2026 | Medium 5.3 Exploited | from 16.0.0 to 16.0.5561.1001 (excluded); from 16.0.0 to 16.0.10417.20175 (excluded); from 16.0.0 to 16.0.19725.20434 (excluded) Fixed in 16.0.5561.1001, 16.0.10417.20175, 16.0.19725.20434 |
| Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability CVE-2026-45659 · July 1, 2026 | High 8.8 Exploited | from 16.0.0 to 16.0.5552.1002 (excluded); from 16.0.0 to 16.0.10417.20128 (excluded); from 16.0.0 to 16.0.19725.20280 (excluded) Fixed in 16.0.5552.1002, 16.0.10417.20128, 16.0.19725.20280 |
| Microsoft SharePoint Server Improper Input Validation Vulnerability CVE-2026-32201 · April 14, 2026 | Medium 6.5 Exploited | from 16.0.0 to 16.0.5548.1003 (excluded); from 16.0.0 to 16.0.10417.20114 (excluded); from 16.0.0 to 16.0.19725.20210 (excluded) Fixed in 16.0.5548.1003, 16.0.10417.20114, 16.0.19725.20210 |
| Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CVE-2026-20963 · March 18, 2026 | Critical 9.8 Exploited | from 16.0.0 to 16.0.5535.1001 (excluded); from 16.0.0 to 16.0.10417.20083 (excluded); from 16.0.0 to 16.0.19127.20442 (excluded) Fixed in 16.0.5535.1001, 16.0.10417.20083, 16.0.19127.20442 |
| Microsoft SharePoint Code Injection Vulnerability CVE-2025-49704 · July 22, 2025 | High 8.8 Exploited | from 16.0.0 to 16.0.5508.1000 (excluded); from 16.0.0 to 16.0.10417.20027 (excluded) Fixed in 16.0.5508.1000, 16.0.10417.20027 |
| Microsoft SharePoint Improper Authentication Vulnerability CVE-2025-49706 · July 22, 2025 | Medium 6.5 Exploited | from 16.0.0 to 16.0.5508.1000 (excluded); from 16.0.0 to 16.0.10417.20027 (excluded); from 16.0.0 to 16.0.18526.20424 (excluded) Fixed in 16.0.5508.1000, 16.0.10417.20027, 16.0.18526.20424 |
| Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CVE-2025-53770 · July 20, 2025 | Critical 9.8 Exploited | from 16.0.0 to 16.0.5513.1001 (excluded); from 16.0.0 to 16.0.10417.20037 (excluded); from 16.0.0 to 16.0.18526.20508 (excluded) Fixed in 16.0.5513.1001, 16.0.10417.20037, 16.0.18526.20508 |
| Microsoft SharePoint Deserialization Vulnerability CVE-2024-38094 · October 22, 2024 | High 7.2 Exploited | from 16.0.0 to 16.0.5456.1000 (excluded); from 16.0.0 to 16.0.10412.20001 (excluded); from 16.0.0 to 16.0.17328.20424 (excluded) Fixed in 16.0.5456.1000, 16.0.10412.20001, 16.0.17328.20424 |
| Microsoft SharePoint Server Code Injection Vulnerability CVE-2023-24955 · March 26, 2024 | High 7.2 Exploited | from 16.0.0 to 16.0.5395.1000 (excluded); from 16.0.0 to 16.0.10398.20000 (excluded); from 16.0.0 to 16.0.16130.20420 (excluded) Fixed in 16.0.5395.1000, 16.0.10398.20000, 16.0.16130.20420 |
| Microsoft SharePoint Server Privilege Escalation Vulnerability CVE-2023-29357 · January 10, 2024 | Critical 9.8 Exploited | from 16.0.0 to 16.0.10399.20005 (excluded) Fixed in 16.0.10399.20005 |
Affected versions are compiled automatically from vendor advisories and NVD and may contain errors. Where no fixed version is shown, you will find it in the official advisory linked from every page: check it there before updating.