What’s Vulnerable › Vulnerabilities

CVE-2020-16950: Microsoft SharePoint Information Disclosure Vulnerability

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-10-16 · updated 2026-06-17

Description

<p>An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.</p> <p>To exploit the vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.</p> <p>The security update addresses the vulnerability by correcting how Microsoft SharePoint Server handles objects in memory.</p>

Affected products

• Microsoft SharePoint Server: 2019
• Microsoft SharePoint Server: from 16.0.0 before publication — fixed in publication

How to fix

Upgrade to a fixed version: Microsoft SharePoint Server publication. Check the vendor advisory for mitigations.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16950

Get alerted when CVE-2020-16950 or the next vulnerability affects your stack