Microsoft Sharepoint Server vulnerabilities

CVE-2026-35439 [HIGH] CWE-502 CVE-2026-35439: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2015-0085 [CRITICAL] CVE-2015-0085: Use-after-free vulnerability in Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Word Use-after-free vulnerability in Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 Gold and SP1, Word 2013 Gold and SP1, Office 2013 RT Gold and SP1, Word 2013 RT Gold and SP1, Excel Viewer, Office Compatibility Pack SP3, Word Automation Services on

CVE-2026-33110 [HIGH] CWE-502 CVE-2026-33110: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2023-24950 [MEDIUM] CWE-20 CVE-2023-24950: Microsoft SharePoint Server Spoofing Vulnerability Microsoft SharePoint Server Spoofing Vulnerability

CVE-2020-0971 [HIGH] CVE-2020-0971: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to chec A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0920, CVE-2020-0929, CVE-2020-0931, CVE-2020-0932, CVE-2020-0974.

CVE-2026-102863 [HIGH] CWE-94 CVE-2026-102863: Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an a Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVE-2026-62827 [HIGH] CWE-287 CVE-2026-62827: Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate priv Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVE-2026-88155 [HIGH] CWE-122 CVE-2026-88155: Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute c Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2026-69273 [HIGH] CWE-284 CVE-2026-69273: Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2026-69282 [HIGH] CWE-284 CVE-2026-69282: Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2026-69268 [HIGH] CWE-284 CVE-2026-69268: Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2014-4117 [CRITICAL] CWE-20 CVE-2014-4117: Microsoft Office 2007 SP3, Word 2007 SP3, Office 2010 SP1 and SP2, Word 2010 SP1 and SP2, Office for Microsoft Office 2007 SP3, Word 2007 SP3, Office 2010 SP1 and SP2, Word 2010 SP1 and SP2, Office for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP1 and SP2, and Word Web Apps 2010 Gold, SP1, and SP2 allow remote attackers to execute arbitrary code via crafted properties in a Word document, aka "Microso

CVE-2020-17118 [CRITICAL] CVE-2020-17118: Microsoft SharePoint Remote Code Execution Vulnerability Microsoft SharePoint Remote Code Execution Vulnerability

CVE-2015-2555 [CRITICAL] CVE-2015-2555: Use-after-free vulnerability in Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2 Use-after-free vulnerability in Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Excel Services on SharePoint Server 2010 SP2 and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted calculatedColumnFormula object in an Office document, aka "Microsoft Office Memory Corru

CVE-2015-2558 [CRITICAL] CVE-2015-2558: Use-after-free vulnerability in Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 Use-after-free vulnerability in Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Excel Viewer, Office Compatibility Pack SP3, and Excel Services on SharePoint Server 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a long fileVersion element

CVE-2015-6094 [CRITICAL] CWE-119 CVE-2015-6094: Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2 Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

CVE-2026-40357 [HIGH] CWE-502 CVE-2026-40357: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2026-70321 [HIGH] CWE-502 CVE-2026-70321: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2026-65665 [HIGH] CWE-502 CVE-2026-65665: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2026-45454 [HIGH] CWE-22 CVE-2026-45454: Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office S Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.