Microsoft Corp Microsoft SharePoint Enterprise Server 2016

Name: Microsoft Corp Microsoft SharePoint Enterprise Server 2016
Brand: Microsoft Corp

productRU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

4critical59high172medium16low

updated 2026-10-26

vulnerabilities (374)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-49704US	—OT critical	100.0% (100th)	KEV	no fix	2025-07-08	—
CVE-2025-49706US	—OT critical	99.1% (100th)	KEV	no fix	2025-07-08	—
CVE-2020-1147US	high7.8OT critical	94.0% (100th)	KEV	no fix	2020-07-14	—
CVE-2023-24955US	—OT critical	85.0% (100th)	KEV	no fix	2023-05-09	—
CVE-2017-11826US	high7.8OT critical	81.3% (100th)	KEV	no fix	2017-10-13	—
CVE-2026-55040US	—OT critical	69.5% (99th)	KEV	no fix	2026-07-14	≤ 16.0.5561.1001
CVE-2026-32201US	medium6.5OT critical	43.4% (99th)	KEV	no fix	2026-04-14	≤ 16.0.5548.1003
CVE-2026-50522US	—OT critical	3.04% (87th)	KEV	no fix	2026-07-14	≤ 16.0.5561.1001
CVE-2026-45659US	—OT critical	2.70% (86th)	KEV	no fix	2026-05-22	—
CVE-2026-65660US	high8.8OT critical	2.10% (82nd)	KEV	no fix	2026-08-11	≤ 16.0.5565.1001
CVE-2026-56164US	critical9.8OT critical	1.01% (63rd)	KEV	no fix	2026-07-14	≤ 16.0.5561.1001
CVE-2024-38094US	—OT critical	50.9% (99th)	KEV	no fix	2024-07-09	—
CVE-2026-20963US	—OT critical	29.2% (98th)	KEV	no fix	2026-01-13	≤ 16.0.5535.1001
CVE-2026-58644US	—OT critical	15.9% (97th)	KEV	no fix	2026-07-14	≤ 16.0.5556.1005
CVE-2025-53771US	—	99.9% (100th)	Exploit	no fix	2025-07-20	—
CVE-2023-21716US	critical9.8	84.8% (100th)	Exploit	no fix	2023-02-14	—
CVE-2020-16952US	medium6.8	71.1% (99th)	Exploit	no fix	2020-10-16	—
CVE-2024-30043US	high7.5	56.1% (99th)	Exploit	no fix	2024-05-14	—
CVE-2023-21742US	—	55.8% (99th)	Exploit	no fix	2023-01-10	—
CVE-2021-31181US	medium6.5	29.0% (98th)	Exploit	no fix	2021-05-11	—
CVE-2025-54897US	—	21.7% (98th)	Exploit	no fix	2025-09-09	—
CVE-2025-47166US	—	21.6% (98th)	Exploit	no fix	2025-06-10	—
CVE-2023-28288US	—	6.23% (94th)	Exploit	no fix	2023-04-11	—
CVE-2019-1006US	high7.5	6.07% (93rd)	Exploit	no fix	2019-07-15	—
CVE-2020-1102US	high8.8	5.22% (93rd)	Exploit	no fix	2020-05-21	—
CVE-2021-31950US	medium5.5	4.56% (92nd)	Exploit	no fix	2021-06-08	—
CVE-2026-26114US	—	2.55% (85th)	Exploit	no fix	2026-03-10	≤ 16.0.5543.1000
CVE-2026-63520US	—	0.96% (61st)	Exploit	no fix	2026-08-11	≤ 16.0.5565.1001
CVE-2024-30044US	—	84.0% (100th)	—	no fix	2024-05-14	—
CVE-2020-1181US	high8.8	69.3% (99th)	—	no fix	2020-06-09	—
CVE-2023-24950US	—	67.5% (99th)	—	no fix	2023-05-09	—
CVE-2024-38023US	—	52.9% (99th)	—	no fix	2024-07-09	—
CVE-2024-38018US	—	51.2% (99th)	—	no fix	2024-09-10	—
CVE-2021-28474US	medium6.5	50.8% (99th)	—	no fix	2021-05-11	—
CVE-2024-38024US	—	45.2% (99th)	—	no fix	2024-07-09	—
CVE-2023-33157US	—	38.2% (99th)	—	no fix	2023-07-11	—
CVE-2024-43464US	—	36.3% (98th)	—	no fix	2024-09-10	—
CVE-2020-0932US	high8.8	35.5% (98th)	—	no fix	2020-04-15	—
CVE-2024-21318US	—	30.8% (98th)	—	no fix	2024-01-09	—
CVE-2018-0792US	high8.8	28.3% (98th)	—	no fix	2018-01-10	—
CVE-2018-0797US	high7.8	24.7% (98th)	—	no fix	2018-01-10	—
CVE-2017-8742US	high7.8	22.1% (98th)	—	no fix	2017-09-13	—
CVE-2019-0585US	high8.8	22.0% (98th)	—	no fix	2019-01-08	—
CVE-2025-47163US	—	20.9% (98th)	—	no fix	2025-06-10	—
CVE-2025-49712US	—	20.7% (98th)	—	no fix	2025-08-12	—
CVE-2020-1439US	high8.8	20.3% (97th)	—	no fix	2020-07-14	—
CVE-2026-20945US	medium5.4	19.1% (97th)	—	no fix	2026-04-14	≤ 16.0.5548.1003
CVE-2025-53760US	—	18.9% (97th)	—	no fix	2025-08-12	—
CVE-2018-1028US	high8.8	18.9% (97th)	—	no fix	2018-04-12	—
CVE-2026-20947US	—	18.4% (97th)	—	no fix	2026-01-13	2 versions

showing 50 of 374

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')97 CVEs
CWE-20Improper Input Validation59 CVEs
CWE-502Deserialization of Untrusted Data40 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor26 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')22 CVEs
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer19 CVEs
CWE-125Out-of-bounds Read19 CVEs
CWE-451User Interface (UI) Misrepresentation of Critical Information16 CVEs

sources (1)

Which sources assert this record, and when.

RUBDU (FSTEC Data Security Threats Database)374 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan