Class familyMicrosoft · SharePoint
Microsoft SharePoint code injection flaws, 2021–2026
7 SharePoint CVEs with CWE-94 weaknesses, 11 May 2021 to 13 Oct 2026. 3 are in CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it..
CVEs by year
Published each year. Select a CVE to open it.Grouped by product and weakness type (CWE); not proven to share a root cause.
2 2021’21
2022’22
2 2023’23
2024’24
1 2025’25
2 2026’26
In CISA KEVNot in KEV
20212 CVEs
20232 CVEs, 1 in KEV
20251 CVE, 1 in KEV
20262 CVEs, 1 in KEV
CVEs in this family
Table view of the years above| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2021-31181 | 11 May 2021 | Microsoft SharePoint Remote Code Execution Vulnerability | Grouped by weakness | 30.8 |
| CVE-2021-40487 | 13 Oct 2021 | Microsoft SharePoint Server Remote Code Execution Vulnerability | Grouped by weakness | 25.4 |
| CVE-2023-24955KEV | 9 May 2023 | Microsoft SharePoint Server Code Injection Vulnerability | Grouped by weakness | 78.0 |
| CVE-2023-33157 | 11 Jul 2023 | Microsoft SharePoint Remote Code Execution Vulnerability | Grouped by weakness | 25.9 |
| CVE-2025-49704KEV | 8 Jul 2025 | Microsoft SharePoint Code Injection Vulnerability | Grouped by weakness | 83.0 |
| CVE-2026-65660KEV | 11 Aug 2026 | Microsoft SharePoint Code Injection Vulnerability | Grouped by weakness | 78.1 |
| CVE-2026-102863 | 13 Oct 2026 | Microsoft Office SharePoint Elevation of Privilege Vulnerability | Grouped by weakness | 18.9 |