Microsoft Microsoft SharePoint Server Subscription Edition

Name: Microsoft Microsoft SharePoint Server Subscription Edition
Brand: Microsoft

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

14critical158high122medium8low

updated 2026-10-26

vulnerabilities (732)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-53770US	—OT critical	100.0% (100th)	KEV	16.0.18526.20508	2025-07-20	2 versions
CVE-2025-49704US	—OT critical	100.0% (100th)	KEV	no fix	2025-07-08	≤ vers:unknown/16.0.0\|<16.0.18526.20424
CVE-2025-49706US	—OT critical	99.1% (100th)	KEV	16.0.18526.20424	2025-07-08	2 versions
CVE-2023-24955US	—OT critical	85.0% (100th)	KEV	16.0.16130.20420	2023-05-09	16.0.0 → 16.0.16130.20420
CVE-2026-45659US	—OT critical	80.2% (100th)	KEV	16.0.19725.20280	2026-05-22	3 versions
CVE-2026-55040US	—OT critical	69.5% (99th)	KEV	16.0.19725.20434	2026-07-14	4 versions
CVE-2026-32201US	medium6.5OT critical	43.4% (99th)	KEV	16.0.19725.20210	2026-04-14	4 versions
CVE-2026-65660US	high8.8OT critical	8.19% (95th)	KEV	16.0.19725.20522	2026-08-11	4 versions
CVE-2026-50522US	—OT critical	3.04% (87th)	KEV	16.0.19725.20434	2026-07-14	4 versions
CVE-2026-21514US	—OT critical	1.59% (75th)	KEV	no fix	2026-02-10	≤ vers:unknown/*
CVE-2026-56164US	critical9.8OT critical	1.01% (63rd)	KEV	16.0.19725.20434	2026-07-14	4 versions
CVE-2024-38094US	—OT critical	50.9% (99th)	KEV	16.0.17328.20424	2024-07-09	16.0.0 → 16.0.17328.20424
CVE-2026-20963US	—OT critical	29.2% (98th)	KEV	16.0.19127.20442	2026-01-13	4 versions
CVE-2026-58644US	—OT critical	15.9% (97th)	KEV	16.0.19725.20384	2026-07-14	4 versions
CVE-2026-96951US	high8.8OT critical	9.81% (96th)	KEV	no fix	2026-10-13	≤ vers:unknown/*
CVE-2025-53771US	—	99.9% (100th)	Exploit	16.0.18526.20508	2025-07-20	2 versions
CVE-2023-21716US	critical9.8	84.8% (100th)	Exploit	16.0.15601.20478	2023-02-14	16.0.0 → 16.0.15601.20478
CVE-2024-30043US	high7.5	56.1% (99th)	Exploit	16.0.17328.20292	2024-05-14	16.0.0 → 16.0.17328.20292
CVE-2023-21742US	—	55.8% (99th)	Exploit	16.0.15601.20418	2023-01-10	16.0.0 → 16.0.15601.20418
CVE-2025-54897US	—	21.7% (98th)	Exploit	16.0.19127.20100	2025-09-09	4 versions
CVE-2025-47166US	—	21.6% (98th)	Exploit	16.0.18526.20396	2025-06-10	2 versions
CVE-2023-28288US	—	6.23% (93rd)	Exploit	16.0.16130.20314	2023-04-11	16.0.0 → 16.0.16130.20314
CVE-2026-26114US	—	3.08% (88th)	Exploit	no fix	2026-03-10	≤ vers:unknown/*
CVE-2025-47175US	—	2.39% (84th)	Exploit	no fix	2025-06-10	≤ vers:unknown/16.0.0\|<16.0.18526.20396
CVE-2025-47165US	—	2.19% (82nd)	Exploit	no fix	2025-06-10	≤ vers:unknown/16.0.0\|<16.0.18526.20396
CVE-2025-47171US	—	1.68% (77th)	Exploit	no fix	2025-06-10	≤ vers:unknown/16.0.0\|<16.0.18526.20396
CVE-2025-47957US	—	1.31% (71st)	Exploit	no fix	2025-06-10	≤ vers:unknown/16.0.0\|<16.0.18526.20396
CVE-2026-63520US	—	0.96% (61st)	Exploit	16.0.19725.20522	2026-08-11	4 versions
CVE-2025-47176US	—	0.75% (55th)	Exploit	no fix	2025-06-10	≤ vers:unknown/16.0.0\|<16.0.18526.20396
CVE-2022-44690US	—	82.1% (100th)	—	15601.20316	2022-12-13	16.0.0 → 15601.20316
CVE-2024-30044US	—	80.8% (100th)	—	16.0.17328.20292	2024-05-14	16.0.0 → 16.0.17328.20292
CVE-2022-38053US	—	76.4% (100th)	—	16.0.15601.20158	2022-10-11	16.0.0 → 16.0.15601.20158
CVE-2023-24950US	—	67.5% (99th)	—	16.0.16130.20420	2023-05-09	16.0.0 → 16.0.16130.20420
CVE-2022-35823US	—	53.8% (99th)	—	16.0.15601.20052	2022-09-13	16.0.0 → 16.0.15601.20052
CVE-2024-38023US	—	52.9% (99th)	—	16.0.17328.20424	2024-07-09	16.0.0 → 16.0.17328.20424
CVE-2024-38018US	—	51.2% (99th)	—	16.0.17928.20086	2024-09-10	16.0.0 → 16.0.17928.20086
CVE-2022-37961US	—	50.9% (99th)	—	16.0.15601.20052	2022-09-13	16.0.0 → 16.0.15601.20052
CVE-2024-38024US	—	45.2% (99th)	—	16.0.17328.20424	2024-07-09	16.0.0 → 16.0.17328.20424
CVE-2023-33157US	—	38.2% (99th)	—	16.0.16130.20642	2023-07-11	16.0.0 → 16.0.16130.20642
CVE-2024-43464US	—	36.3% (98th)	—	16.0.17928.20086	2024-09-10	16.0.0 → 16.0.17928.20086
CVE-2026-45484US	—	35.2% (98th)	—	16.0.19725.20384	2026-06-09	4 versions
CVE-2025-21400US	—	34.2% (98th)	—	16.0.17928.20396	2025-02-11	16.0.0 → 16.0.17928.20396
CVE-2026-33112US	—	31.1% (98th)	—	16.0.19725.20280	2026-05-12	4 versions
CVE-2024-21318US	—	30.8% (98th)	—	16.0.10406.20000	2024-01-09	16.0.0 → 16.0.10406.20000
CVE-2025-29793US	—	23.6% (98th)	—	16.0.18526.20172	2025-04-08	16.0.0 → 16.0.18526.20172
CVE-2025-47163US	—	20.9% (98th)	—	16.0.18526.20396	2025-06-10	2 versions
CVE-2026-20945US	medium5.4	19.1% (97th)	—	16.0.19725.20210	2026-04-14	4 versions
CVE-2025-53760US	—	18.9% (97th)	—	16.0.18526.20518	2025-08-12	16.0.0 → 16.0.18526.20518
CVE-2026-20947US	—	18.4% (97th)	—	16.0.19127.20442	2026-01-13	4 versions
CVE-2022-22005US	medium6.5	16.5% (97th)	—	16.0.14326.20742	2022-02-09	16.0.0 → 16.0.14326.20742

showing 50 of 732

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-122Heap-based Buffer Overflow144 CVEs
CWE-416Use After Free99 CVEs
CWE-125Out-of-bounds Read97 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')61 CVEs
CWE-20Improper Input Validation55 CVEs
CWE-502Deserialization of Untrusted Data51 CVEs
CWE-121Stack-based Buffer Overflow25 CVEs
CWE-190Integer Overflow or Wraparound24 CVEs

sources (3)

Which sources assert this record, and when.

NLNCSC-NL (CSAF)624 CVEs
EUEU Vulnerability Database (ENISA)218 CVEs
USMicrosoft MSRC (CSAF)177 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan