Fixes 7 records
Priority CRITICAL 100KEV
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.29201 · Published 2026-01-13 · Fixed in 16.0.5535.1001, 16.0.10417.20083 +1 CWE-502
Priority MEDIUM 58
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.18442 · Published 2026-01-13 · Fixed in 16.0.5535.1001, 16.0.10417.20083 +1 CWE-89
Priority LOW 37
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00794 · Published 2026-01-13 · Fixed in 16.0.5535.1001, 16.0.10417.20083 +1 CWE-20
Priority LOW 37
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00597 · Published 2026-01-13 · Fixed in https://aka.ms/OfficeSecurityReleases, 16.105.26011018 +3 CWE-822
Priority LOW 35
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.07681 · Published 2026-01-13 · Fixed in 16.0.5535.1001, 16.0.10417.20083 +1 CWE-79
Priority LOW 34
Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS 3.1HIGH 7.0· Local · No auth · User interaction · EPSS 0.00646 · Published 2026-01-13 · Fixed in 16.0.5535.1000, 16.0.19426.20170 +3 CWE-426
Priority LOW 24
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00348 · Published 2026-01-13 · Fixed in 16.0.5535.1001, 16.0.10417.20083 +1 CWE-918
THREATIST.IORead the docs