Improper input validation within Microsoft Office SharePoint Server allows an attacker to spoof identities over the network. This flaw can lead to unauthorized authentication, letting a malicious actor impersonate legitimate users or services and potentially gain access to sensitive content or functionalities. It is a classic input validation flaw (CWE‑20).

The vulnerability affects Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition. The advisory does not specify limited versions, indicating that all current releases of these products may be vulnerable.

The CVSS score of 6.5 reflects moderate severity, yet the flaw is listed in the CISA Known Exploited Vulnerabilities catalog, meaning it has already been exploited in the wild. The EPSS score is 1%, indicating a low but nonzero probability of exploitation. The likely attack vector is network‑based spoofing, where an unauthenticated attacker crafts input to the SharePoint services to impersonate valid identities.