Microsoft Sharepoint Enterprise Server 2016 vulnerabilities, page 4
335 vulnerabilities
Known vulnerabilities in Microsoft Sharepoint Enterprise Server 2016, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-62559microsoft365_apps+13
EPSS score0.64%
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-62204microsoftmicrosoft sharepoint enterprise server 2016+3EPSS score2.21%
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-62558microsoft365_apps+13EPSS score0.64%
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-62562microsoft365_apps+13EPSS score0.81%
Use after free in Microsoft Office Outlook allows an unauthorized attacker to execute code locally.CVE-2025-62555microsoft365_apps+13EPSS score0.52%
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-47166microsoftmicrosoft sharepoint enterprise server 2016+4EPSS score21.64%
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-47172microsoftmicrosoft sharepoint enterprise server 2016+4EPSS score1.75%
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-47168microsoft365_apps+14EPSS score0.64%
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-47163microsoftmicrosoft sharepoint enterprise server 2016+4EPSS score20.92%
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-47169microsoft365_apps+14EPSS score0.65%
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-53736microsoft365_apps+14EPSS score0.50%
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.CVE-2025-53771microsoftmicrosoft sharepoint enterprise server 2016+3EPSS score99.86%
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.CVE-2025-53760microsoftmicrosoft sharepoint enterprise server 2016+3EPSS score18.93%
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2025-53770microsoftmicrosoft sharepoint enterprise server 2016+3KEVRansomwareEPSS score100.00%
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.
Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild.
Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.CVE-2025-53733microsoft365_apps+14EPSS score0.55%
Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-29793microsoftmicrosoft sharepoint enterprise server 2016+4EPSS score23.63%
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-29794microsoftmicrosoft sharepoint enterprise server 2016+4EPSS score4.76%
Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-29976microsoftmicrosoft sharepoint enterprise server 2016+3EPSS score0.64%
Improper privilege management in Microsoft Office SharePoint allows an authorized attacker to elevate privileges locally.CVE-2025-29820microsoft365_apps+11EPSS score0.77%
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-27747microsoft365_apps+14EPSS score0.82%
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.