> ## Content Index
> Fetch the complete content index at: https://www.thecybersignal.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# CISA Issues Urgent Patch Mandate for SharePoint Zero-Day and ‘Ancient’ Excel Bug
- URL: https://www.thecybersignal.com/cisa-issues-urgent-patch-mandate-for-sharepoint-zero-day-and-ancient-excel-bug/
- Published: 2026-04-16T02:53:59.000Z
- Updated: 2026-07-15T11:14:56.000Z
- Author: Nicholas Robert

*Following a massive Patch Tuesday release addressing 169 vulnerabilities, federal authorities have added two high-risk Microsoft flaws to the Known Exploited Vulnerabilities (KEV) catalog — including a legacy bug from 2009.*

**WASHINGTON, D.C.** — The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its [**Known Exploited Vulnerabilities (KEV) catalog**](https://www.thecybersignal.com/cisa-expands-kev-catalog-with-seven-actively-exploited-flaws-across-microsoft-adobe-and-fortinet/), adding a critical SharePoint zero-day and a 17-year-old Microsoft Excel vulnerability. The move comes as Microsoft’s April 2026 Patch Tuesday addressed a staggering 169 flaws, two of which were confirmed to be under active exploitation before fixes were available.

The two additions represent a growing trend of threat actors utilizing a "dual-track" strategy: weaponizing the latest software architectural gaps while reaching back nearly two decades to exploit legacy code that remains embedded in modern enterprise environments.

| CVE ID         | Affected Product                         | Patch Deadline |
| -------------- | ---------------------------------------- | -------------- |
| CVE-2026-32201 | Microsoft SharePoint Server (Zero-Day)   | Apr 28, 2026   |
| CVE-2009-0238  | Microsoft Office Excel 2007 (Legacy RCE) | Apr 28, 2026   |

---

## The SharePoint Breach: CVE-2026-32201

The primary focus of the April update is **CVE-2026-32201**, an "Improper Input Validation" (Spoofing) vulnerability in Microsoft SharePoint Server. Despite being rated as "Medium" severity by CVSS standards, Microsoft and CISA elevated its priority after confirming "exploitation detected" in the wild.

The flaw allows an attacker to bypass security prompts or hijack sessions within a SharePoint environment, potentially serving as a gateway for lateral movement into broader Microsoft 365 tenants. Federal agencies have been ordered to remediate this flaw by **April 28, 2026**.

## The 17-Year-Old "Ghost": CVE-2009-0238

In a move that surprised some security researchers, CISA also added **CVE-2009-0238**, a Remote Code Execution (RCE) vulnerability in Microsoft Office Excel 2007\. The bug, which involves an "invalid memory pointer" error, was once a staple of early malware campaigns like *Trojan.Mdropper.AC*.

Its sudden reappearance in the KEV suggests that [state-sponsored actors](https://www.thecybersignal.com/what-is-a-nation-state-cyberattack/) or sophisticated ransomware groups are successfully targeting older versions of Office still found in air-gapped systems or industrial control environments that lack modern endpoint protection.

---

## The CyberSignal Analysis

### Signal 01 — The Resurgence of Legacy Exploits

The inclusion of a 2009 bug is a stark reminder that vulnerabilities don't "expire." For CISOs, this is a signal that "[vulnerability management](https://www.thecybersignal.com/tag/vulnerability-management/)" cannot just focus on the latest CVEs. Threat actors are performing "archaeological" security research, betting that organizations have stopped monitoring for exploits that were supposedly "solved" during the Windows 7 era.

### Signal 02 — The SharePoint Perimeter

SharePoint remains a "soft target" for identity-based attacks. Because it sits at the intersection of external collaboration and internal file storage, even a "Spoofing" vulnerability like CVE-2026-32201 can be leveraged to steal high-value credentials or exfiltrate sensitive IP. The speed of this KEV addition (less than 48 hours after Patch Tuesday) indicates that the volume of active attacks is significant.

---

## Sources

| Type           | Source                                                                                                                                                                                                                                         |
| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Tech Intel     | [Hacker News: SharePoint Zero-Day Fixes](https://thehackernews.com/2026/04/microsoft-issues-patches-for-sharepoint.html?ref=thecybersignal.com)                                                                                                |
| Security Alert | [SecurityWeek: April Patch Tuesday Analysis](https://www.securityweek.com/microsoft-patches-exploited-sharepoint-zero-day-and-160-other-vulnerabilities/?ref=thecybersignal.com)                                                               |
| Catalog Entry  | [Security Affairs: CISA KEV Catalog Updates](https://securityaffairs.com/190852/hacking/u-s-cisa-adds-microsoft-sharepoint-server-and-microsoft-office-excel-flaws-to-its-known-exploited-vulnerabilities-catalog.html?ref=thecybersignal.com) |