CVE-2026-32201
Actively exploited. CVE-2026-32201 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-04-14) — exploitation has been observed in the wild, and US federal agencies are required to remediate it under BOD 22-01. Treat patching as urgent.
JPCERT-AT-2026-0010
JPCERT/CC
2026-04-15
I. Overview
Microsoft has released April 2026 Security Updates to address the vulnerabilities in their products. Attackers leveraging these vulnerabilities may be able to perform spoofing over a network, or execute arbitrary code remotely without authentication, etc.
Microsoft Corporation
April 2026 Security Updates
https://msrc.microsoft.com/update-guide/en-us/releaseNote/2026-Apr
According to Microsoft, among the vulnerabilities, the following vulnerability has been confirmed to be exploited in the wild. Please consider applying the security update programs by referring to the information provided by Microsoft.
CVE-2026-32201
Microsoft SharePoint Server Spoofing Vulnerability
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32201
II. Solution
Please apply the security update programs through Microsoft Update, Windows Update, etc.
Microsoft Update Catalog
https://www.catalog.update.microsoft.com/
Windows Update: FAQ
https://support.microsoft.com/en-us/help/12373/windows-update-faq
III. References
Microsoft Corporation
Release Notes
https://msrc.microsoft.com/update-guide/
If you have any information regarding this alert, please contact JPCERT/CC.
JPCERT Coordination Center (Cyber Security Coordination Group)
MAIL: ew-info@jpcert.or.jp
https://www.jpcert.or.jp/english/
CSIRTS triage
- What
- A spoofing vulnerability allows attackers to execute arbitrary code remotely without authentication.
- Who is affected
- Users of Microsoft SharePoint Server are affected.
- Urgency
- Remediation is urgent as the vulnerability has been exploited in the wild.
- Action
- Apply the security update programs through Microsoft Update.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-32201
Get an email if CVE-2026-32201 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Exploitation confirmedAlready exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 98% of all EPSS-scored CVEs.
Advisory coverage (2)
- unknownexploitedSecurity Alert: Microsoft Releases April 2026 Security Updatesjpcert · 2026-04-15
- criticalexploitedCVE-2026-32201: Microsoft SharePoint Server Improper Input Validation Vulnerabilitycisa-kev · 2026-04-14
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-32201)