Microsoft Microsoft SharePoint Server 2019

Name: Microsoft Microsoft SharePoint Server 2019
Brand: Microsoft

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

15critical159high193medium20low

updated 2026-10-26

vulnerabilities (824)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-53770US	—OT critical	100.0% (100th)	KEV	16.0.10417.20037	2025-07-20	2 versions
CVE-2025-49704US	—OT critical	100.0% (100th)	KEV	16.0.10417.20027	2025-07-08	2 versions
CVE-2023-29357US	—OT critical	100.0% (100th)	KEV	16.0.10399.20005	2023-06-14	16.0.0 → 16.0.10399.20005
CVE-2025-49706US	—OT critical	99.1% (100th)	KEV	16.0.10417.20027	2025-07-08	2 versions
CVE-2023-24955US	—OT critical	85.0% (100th)	KEV	16.0.10398.20000	2023-05-09	16.0.0 → 16.0.10398.20000
CVE-2026-55040US	—OT critical	69.5% (99th)	KEV	16.0.10417.20175	2026-07-14	4 versions
CVE-2026-32201US	medium6.5OT critical	43.4% (99th)	KEV	16.0.10417.20114	2026-04-14	4 versions
CVE-2026-50522US	—OT critical	3.04% (87th)	KEV	16.0.10417.20175	2026-07-14	4 versions
CVE-2026-45659US	—OT critical	2.70% (86th)	KEV	16.0.10417.20128	2026-05-22	3 versions
CVE-2026-65660US	high8.8OT critical	2.10% (82nd)	KEV	16.0.10417.20198	2026-08-11	4 versions
CVE-2026-21514US	—OT critical	1.59% (75th)	KEV	no fix	2026-02-10	≤ vers:unknown/*
CVE-2026-56164US	critical9.8OT critical	1.01% (63rd)	KEV	16.0.10417.20175	2026-07-14	4 versions
CVE-2024-38094US	—OT critical	50.9% (99th)	KEV	16.0.10412.20001	2024-07-09	16.0.0 → 16.0.10412.20001
CVE-2026-20963US	—OT critical	29.2% (98th)	KEV	16.0.10417.20083	2026-01-13	4 versions
CVE-2026-58644US	—OT critical	15.9% (97th)	KEV	16.0.10417.20153	2026-07-14	4 versions
CVE-2026-96951US	high8.8OT critical	1.51% (74th)	KEV	no fix	2026-10-13	≤ vers:unknown/*
CVE-2025-53771US	—	99.9% (100th)	Exploit	16.0.10417.20037	2025-07-20	2 versions
CVE-2023-21716US	critical9.8	84.8% (100th)	Exploit	16.0.10395.20001	2023-02-14	16.0.0 → 16.0.10395.20001
CVE-2020-16952US	medium6.8	71.1% (99th)	Exploit	publication	2020-10-16	16.0.0 → publication
CVE-2024-30043US	high7.5	56.1% (99th)	Exploit	16.0.10409.20047	2024-05-14	16.0.0 → 16.0.10409.20047
CVE-2023-21742US	—	55.8% (99th)	Exploit	16.0.10394.20021	2023-01-10	16.0.0 → 16.0.10394.20021
CVE-2021-31181US	medium6.5	29.0% (98th)	Exploit	16.0.10374.20000	2021-05-11	16.0.0 → 16.0.10374.20000
CVE-2025-54897US	—	21.7% (98th)	Exploit	16.0.10417.20047	2025-09-09	4 versions
CVE-2025-47166US	—	21.6% (98th)	Exploit	16.0.10417.20018	2025-06-10	2 versions
CVE-2023-28288US	—	6.23% (94th)	Exploit	16.0.10397.20002	2023-04-11	16.0.0 → 16.0.10397.20002
CVE-2021-31950US	medium5.5	4.56% (92nd)	Exploit	16.0.10375.20000	2021-06-08	16.0.0 → 16.0.10375.20000
CVE-2026-26114US	—	2.55% (85th)	Exploit	16.0.10417.20102	2026-03-10	4 versions
CVE-2025-47175US	—	2.39% (84th)	Exploit	no fix	2025-06-10	≤ vers:unknown/16.0.0\|<16.0.10417.20018
CVE-2025-47165US	—	2.19% (82nd)	Exploit	no fix	2025-06-10	≤ vers:unknown/16.0.0\|<16.0.10417.20018
CVE-2025-47171US	—	1.68% (77th)	Exploit	no fix	2025-06-10	≤ vers:unknown/16.0.0\|<16.0.10417.20018
CVE-2025-47957US	—	1.31% (71st)	Exploit	no fix	2025-06-10	≤ vers:unknown/16.0.0\|<16.0.10417.20018
CVE-2026-63520US	—	0.96% (61st)	Exploit	16.0.10417.20198	2026-08-11	4 versions
CVE-2025-47176US	—	0.75% (54th)	Exploit	no fix	2025-06-10	≤ vers:unknown/16.0.0\|<16.0.10417.20018
CVE-2024-30044US	—	84.0% (100th)	—	16.0.10409.20047	2024-05-14	16.0.0 → 16.0.10409.20047
CVE-2022-44690US	—	82.1% (100th)	—	10393.20000	2022-12-13	16.0.0 → 10393.20000
CVE-2022-38053US	—	76.4% (100th)	—	16.0.10391.20000	2022-10-11	16.0.0 → 16.0.10391.20000
CVE-2023-24950US	—	67.5% (99th)	—	16.0.10398.20000	2023-05-09	16.0.0 → 16.0.10398.20000
CVE-2022-35823US	—	53.8% (99th)	—	16.0.10390.20000	2022-09-13	16.0.0 → 16.0.10390.20000
CVE-2024-38023US	—	52.9% (99th)	—	16.0.10412.20001	2024-07-09	16.0.0 → 16.0.10412.20001
CVE-2024-38018US	—	51.2% (99th)	—	16.0.10414.20002	2024-09-10	16.0.0 → 16.0.10414.20002
CVE-2022-37961US	—	50.9% (99th)	—	16.0.10390.20000	2022-09-13	16.0.0 → 16.0.10390.20000
CVE-2021-28474US	medium6.5	50.8% (99th)	—	16.0.10374.20000	2021-05-11	16.0.0 → 16.0.10374.20000
CVE-2021-40487US	medium6.5	48.2% (99th)	—	16.0.10379.20000	2021-10-13	16.0.0 → 16.0.10379.20000
CVE-2024-38024US	—	45.2% (99th)	—	16.0.10412.20001	2024-07-09	16.0.0 → 16.0.10412.20001
CVE-2023-33157US	—	38.2% (99th)	—	16.0.10400.20008	2023-07-11	16.0.0 → 16.0.10400.20008
CVE-2024-43464US	—	36.3% (98th)	—	16.0.10414.20002	2024-09-10	16.0.0 → 16.0.10414.20002
CVE-2025-21400US	—	34.2% (98th)	—	16.0.10416.20050	2025-02-11	16.0.0 → 16.0.10416.20050
CVE-2024-21318US	—	30.8% (98th)	—	16.0.10406.20000	2024-01-09	16.0.0 → 16.0.10406.20000
CVE-2025-29793US	—	23.6% (98th)	—	16.0.10417.20003	2025-04-08	16.0.0 → 16.0.10417.20003
CVE-2025-47163US	—	20.9% (98th)	—	16.0.10417.20018	2025-06-10	2 versions

showing 50 of 824

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-122Heap-based Buffer Overflow144 CVEs
CWE-125Out-of-bounds Read103 CVEs
CWE-416Use After Free99 CVEs
CWE-20Improper Input Validation81 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')73 CVEs
CWE-502Deserialization of Untrusted Data54 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor30 CVEs
CWE-121Stack-based Buffer Overflow25 CVEs

sources (3)

Which sources assert this record, and when.

NLNCSC-NL (CSAF)624 CVEs
EUEU Vulnerability Database (ENISA)342 CVEs
USMicrosoft MSRC (CSAF)131 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan