Read the docs
TI-2020-01403 Aliases CVE-2020-1444GHSA-gvgq-x76m-m83j

A remote code execution vulnerability exists in the way Microsoft SharePoint software…

Priority LOW 32Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A remote code execution vulnerability exists in the way Microsoft SharePoint software parses specially crafted email messages, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'.

Why it matters now

EPSS 0.0905 95th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft SharePoint Enterprise Server2016—No fix listedCNA
MicrosoftMicrosoft SharePoint Server2019—No fix listedCNA
MicrosoftMicrosoft SharePoint Foundation2013 Service Pack 1—No fix listedCNA
  • Microsoft SharePoint Enterprise Server VendorMicrosoft Affected 2016 Fixed in — No fix listed CNA
  • Microsoft SharePoint Server VendorMicrosoft Affected 2019 Fixed in — No fix listed CNA
  • Microsoft SharePoint Foundation VendorMicrosoft Affected 2013 Service Pack 1 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*2016VulnerableMicrosoft
cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*2013 sp1VulnerableMicrosoft
cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*2019VulnerableMicrosoft
  • cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:* Versions 2016 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-1444
  2. 2026-10-03 Alias added: GHSA-gvgq-x76m-m83j

References

Patch 1

  • TI-2019-00394 Improper input validation in Microsoft SharePoint Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01112 A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and… KEVCVSS 3.1HIGH 7.8
  • TI-2017-08774 Memory corruption in Microsoft Office KEVCVSS 3.1HIGH 7.8
  • TI-2023-10439 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 7.2
  • TI-2023-08100 Microsoft Word Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2025-31676 Microsoft SharePoint Server Spoofing Vulnerability KEVCVSS 3.1MEDIUM 6.5
See all 255 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences