SharePoint vulnerability scanner for known security issues
Find out which SharePoint Server version you expose to the internet and check it for known vulnerabilities, including critical issues such as ToolShell.
Quick update: In October 2026, we retired the standalone SharePoint Scanner. You can now use the Network Scanner instead, which already covers SharePoint detections such as ToolShell and CVE-2026-55040 (JWT authentication bypass).
Unlock full capabilities
Monitor your assets for exposure to new, critical vulnerabilities with our full Continuous scanning & validation product.
Find out which SharePoint Server version you expose to the internet and check it for known vulnerabilities, including critical issues such as ToolShell.
Quick update: In October 2026, we retired the standalone SharePoint Scanner. You can now use the Network Scanner instead, which already covers SharePoint detections such as ToolShell and CVE-2026-55040 (JWT authentication bypass).
What does a SharePoint security check cover?
A SharePoint security check identifies an internet-facing SharePoint Server and checks it for known vulnerabilities.
An exposed SharePoint version can give attackers useful information about which known vulnerabilities may affect the server, making it important to identify and patch vulnerable installations quickly.
The vulnerability scan applies to the SharePoint Server that you host yourself. Microsoft runs and patches SharePoint Online in Microsoft 365, so it sits outside this kind of external check.
Why SharePoint security matters: what ToolShell showed
In July 2025, attackers exploited ToolShell (CVE-2025-53770, CVSS v3.1 base score 9.8) before a complete fix existed. The flaw allowed unauthenticated remote code execution on on-premises SharePoint Server 2016, 2019, and Subscription Edition. SharePoint Online wasn't affected. CISA added CVE-2025-53770 to its Known Exploited Vulnerabilities catalog on July 20, 2025.
Patching wasn't the end of it. Responders reported attackers stealing ASP.NET machine keys, which let them keep access to a server after it was patched (WithSecure analysis).
The lesson outlasts this CVE: know which SharePoint servers face the internet, apply security updates quickly, and check for signs of compromise after patching. Continuous vulnerability monitoring can then help you identify newly detectable issues.
Our Network Scanner detects ToolShell and can identify the web shell associated with previous exploitation, helping you check for signs of compromise even after patching. See the ToolShell entry in our Vulnerabilities & Exploits database for more details.
How to scan SharePoint with the Network Scanner
Our Network Scanner checks the hosts you give it, so the workflow starts with knowing where your SharePoint servers are.
Add your SharePoint hosts
Add each SharePoint host as a Network Scanner target, as a hostname such as sharepoint.example.com or an IP address. You can also import a list of hosts from the Assets page.
Scan with all engines enabled
Run a Deep or Custom scan with all engines enabled.
Catch new SharePoint CVEs
Schedule recurring scans so your subdomains are checked against new SharePoint detections as you add them to your list of Assets. You can also schedule scans after Patch Tuesday to verify newly patched systems.
SharePoint vulnerability detections run on all paid plans that include the Network Scanner.
SharePoint pentesting: when deeper testing makes sense
A scan identifies known vulnerabilities and exposures it can detect remotely.
A SharePoint penetration test goes further by testing what an attacker could do with them. It typically covers:
authenticated access, and what a regular user account can reach across sites and libraries
broken permission inheritance, where a sensitive library ends up readable by everyone
custom web parts, workflows, and integrations that no public detection knows about
paths from SharePoint into Active Directory and the rest of the network.
Start with scanning to identify known issues, then use deeper testing for permissions, custom functionality, and attack paths that require additional investigation. When you need that depth, our offensive security services team runs it.
How to fix SharePoint security issues
Apply the latest security updates for your SharePoint Server version.
For ToolShell, follow Microsoft's full customer guidance, which goes beyond installing the update: rotate the ASP.NET machine keys and check the server for signs of compromise.
Turn off anonymous access where nobody needs it, and remove web services you don't use.
If a server doesn't need to face the internet, put it behind a VPN or an authenticating reverse proxy.
Re-scan to confirm the fix, then enable vulnerability monitoring to check for newly detected vulnerabilities over time.
If you used the SharePoint Scanner
Scheduled and API-triggered SharePoint Scanner scans stopped in November 2026. Your existing SharePoint Scanner reports remain available in your account. To keep covering the same servers, add them to a scheduled Network Scanner scan.
SharePoint security FAQs
Does the Network Scanner check SharePoint Online?
No. Its SharePoint fingerprinting reads headers that on-premises SharePoint Server returns. Microsoft manages SharePoint Online, including its patching.
Does it detect ToolShell (CVE-2025-53770)?
Yes. The Network Scanner detects it, without exploiting it. See the ToolShell entry for details.
Can I check SharePoint security for free?
Not with the Network Scanner. The free light scan doesn't include the SharePoint detections, which run on all paid plans.
For free, you can check the SharePoint build number manually and compare it with Microsoft’s published SharePoint update history and security advisories.
Is the scan safe to run against a production SharePoint server?
The Network Scanner fingerprints the SharePoint version and runs checks for known SharePoint vulnerabilities such as CVE-2026-58644 (WS-Federation BinaryFormatter Deserialization RCE) and CVE-2019-0604 (remote code execution).
We recommend scheduling scans outside peak hours if load matters.
Always make sure to scan only servers you're authorized to test.
Can it run authenticated checks against SharePoint?
No, the Network Scanner cannot run authenticated checks against SharePoint.
Where are my old SharePoint Scanner reports?
In your account, under your past scans.
Match testing depth to the server
A SharePoint server is one asset in a wider estate. The Network Scanner is part of our Continuous scanning & validation product: continuous web, network, and cloud scanning with 17,400+ detections and exploit modules, safe exploitation where supported, and evidence captured with each finding.
For SharePoint permissions, custom code, and attack paths into your network, our offensive security services team brings certified specialists for manual testing adapted to your organization’s context and compliance requirements.