This vulnerability in Microsoft SharePoint Enterprise Server 2016 (CVE-2026-32201) stems from improper input validation (CWE-20). It enables an unauthorized attacker to conduct spoofing attacks remotely without requiring privileges or user interaction. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality and integrity but not availability. Microsoft has published an official fix for affected versions prior to 16.0.5548.1003.

An attacker can exploit this vulnerability to spoof network communications, potentially misleading users or systems about the source or content of data. This can lead to limited confidentiality and integrity impacts. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update for Microsoft SharePoint Enterprise Server 2016 to versions 16.0.5548.1003 or later as provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201. No additional mitigation steps are indicated by the vendor.