Microsoft has disclosed a new spoofing vulnerability affecting SharePoint Enterprise Server 2016, 2019, and Subscription Edition. CISA added it to their Known Exploited Vulnerabilities catalogue the same day the patch was released, and ordered US federal agencies to patch by 28 April 2026.

As of this week, researchers have identified 1,370 SharePoint servers still publicly exposed and unpatched, more than a week after Microsoft released the fix.

And as Kyle pointed out in our conversation, that number is almost certainly understated.

The previous vulnerability was a Remote Code Execution flaw, which means an attacker could run any code they wanted on the system. Last week's vulnerability is described as a spoofing vulnerability, which sounds less alarming, but is worth understanding properly.

It is tempting to look at 1,370 unpatched servers and assume those organisations are simply not paying attention. The reality is more nuanced.

For organisations running large or complex SharePoint environments, applying a patch is not a single click. It often involves a structured release process: testing the patch in a staging environment, validating that it does not break existing integrations, and pushing it through a formal change management board for approval. In heavily regulated industries, that approval chain alone can take weeks.

This is the question we asked Kyle directly, and his answer is one every business leader should sit with for a moment. SharePoint is not a particularly insecure platform. It sits behind multiple layers of defence and integrates tightly with Active Directory and Microsoft Entra ID.

What has changed is that SharePoint has become a far more valuable target. Since SharePoint 2016, the platform has matured significantly, and many of the largest organisations in the world now run mission-critical environments on it. Larger, more valuable deployments mean attackers have a stronger commercial incentive to invest time in finding ways in.

There is also a second factor: artificial intelligence. AI tools are helping attackers analyse code paths and chain together small, individually low-severity vulnerabilities into something far more dangerous.

In other words, you cannot only worry about the headline-grabbing CVEs. The medium-severity ones matter too, because attackers are increasingly stitching them together.

SharePoint Server 2016 reaches end of extended support on 14 July 2026. After that date, Microsoft will no longer issue security patches for SharePoint 2016. Whatever vulnerabilities exist in the code, including ones not yet discovered, will remain there permanently.

If you are running SharePoint 2016 and you have not yet started a migration conversation, this is the signal to start. The migration path is not a single jump. Organisations on 2016 cannot move directly to SharePoint Subscription Edition. They need to upgrade to 2019 first, then to Subscription Edition, or rebuild the environment and migrate the data across using a migration tool.

Both options take time. Three months out from the deadline, that time is now the constraint.

If you are not sure whether your SharePoint environment is patched, exposed, or ready for the July 2026 deadline, our team can help you find out. We offer SharePoint security assessments, vulnerability scans, penetration testing, patch verification, and full migration planning for SharePoint 2016 environments.

Reach out to us and we will walk through your environment with you. 

For SharePoint on-premises users, the retirement means Microsoft stops providing support, updates, and security patches. The forms may continue to function, but you’re operating on borrowed time with unsupported software. That creates real risk across three areas:

This is where organisations often get stuck. Not every InfoPath form should be rebuilt the same way. The right replacement depends on what the form does and how complex it is.

For forms that are part of broader business processes and need rich integration with other systems, Power Apps is often the right direction. It’s Microsoft’s official successor to InfoPath, tightly integrated with SharePoint, Teams, and the wider Power Platform. For workflows, Power Automate replaces what SharePoint Designer used to do.

But here’s the honest truth: Power Apps isn’t always the fastest path for straightforward SharePoint list forms. Some forms don’t need the full Power Platform treatment. They need a modern, responsive form that works natively in SharePoint without the overhead of a canvas app build.

This is where it gets practical. One of the biggest headaches with InfoPath migration is the manual effort. Reading form designs, recreating layouts, reconnecting data sources, rebuilding logic. For organisations with dozens or hundreds of forms, that’s months of work.

GTconsult partners with Lightning Tools, whose Form Migrator is purpose-built for exactly this problem. The tool scans your SharePoint environment, detects InfoPath forms, reads the form design including layout, images, repeating tables, and logic, and lets you preview the form before publishing it to a SharePoint list.

From there, you have flexible options. You can migrate to Power Apps for forms that need standalone app capabilities. Or you can migrate to Lightning Forms for SharePoint-native forms with conditional formatting, cross-site lookups, and automation built in. The Form Migrator handles both form design and data migration, preserving field values, attachments, metadata, and relationships.

The entire process runs locally on your workstation. No form data leaves your environment. For security-conscious organisations, that matters.

Lightning Tools also includes an ROI calculator within the tool, so you can see exactly what the migration saves you compared to rebuilding forms from scratch.

Need help with your InfoPath migration?

Chat to GTconsult. Let’s assess your environment and build a plan before the deadline.

In July 2025, Microsoft disclosed a critical vulnerability known as ToolShell (CVE-2025-53770), rated 9.8 out of 10 on the severity scale (where 10 is the most dangerous possible). This vulnerability affected all supported versions of SharePoint On-Premises: SharePoint Server 2016, 2019, and Subscription Edition.

What made this particularly alarming was that attackers didn't need a password or any prior access to your system. If they could reach your SharePoint server, they could get in.

Before Microsoft could fully patch the issue, more than 400 organisations globally had already been compromised, including US government agencies. Chinese state-sponsored threat actors were among those identified, alongside ransomware groups who exploited the same vulnerability for financial gain.

That was 2025. In 2026, the attacks have continued.

SharePoint is not just a file storage system. For many organisations, it is the central nervous system of the business, holding sensitive documents, running workflows, storing employee data, and connecting to other Microsoft services like Teams, Outlook, and OneDrive.

When an attacker gets into SharePoint, they don't just see your files. They can:

•  Move laterally across your entire Microsoft environment

•  Access sensitive business and personal data

•  Install backdoors that persist even after patches are applied

•  Deploy ransomware across your network

•  Steal credentials and impersonate trusted users

And here is the part that should concern every business leader most: you may not know it has happened. These attacks are designed to be quiet. By the time you notice something is wrong, the attacker may have been inside your systems for weeks or months.

If you answered yes to the first question and no to any of the others, your organisation is carrying unnecessary risk.

This is not a moment for a committee to review and report back in 30 days. The following actions need to be on your IT team's desk this week:

We are not here to tell every organisation to move to the cloud. There are legitimate reasons (regulatory requirements, data sovereignty, legacy integrations) why some organisations must keep SharePoint On-Premises.

But the security overhead is real and growing. Every critical vulnerability that Microsoft patches in the cloud automatically means nothing to an on-premises customer who hasn't applied the update. The responsibility sits squarely with your IT team, and the window between disclosure and exploitation is shrinking.

And then there is the end-of-life reality. SharePoint Server 2016 and SharePoint Server 2019 both reach end of support on 14 July 2026, just 90 days from now. After that date, Microsoft will release no further security patches for either version. Any vulnerability discovered after July 2026 will remain permanently unpatched on those platforms. If you are running SharePoint Server Subscription Edition, you are not affected by this deadline — it remains supported with no fixed end date. But if you are on 2016 or 2019, the options are clear: migrate to SharePoint Online, upgrade to SharePoint Server Subscription Edition, or accept an ever-growing security exposure with no vendor safety net.

If you are running On-Premises purely out of habit, inertia, or because it has always been that way: the clock is no longer just ticking. It has nearly run out.

Looking across the common failure patterns, there's a single theme: legacy script patterns that nobody had revisited in years. The solutions that broke were rarely recently built, they were older integrations, older web parts, scripts embedded when SharePoint was configured years ago and then forgotten.

CSP enforcement didn't create new problems; it surfaced old ones. That's actually the point. The report-only window from late 2025 through 28 February was designed exactly for this: a chance to audit before enforcement hit. Teams that used that window had nothing to worry about on 1 March. Teams that didn't are doing triage now.

When Microsoft announced SharePoint Online's Content Security Policy enforcement in early 2026, they included a lifeline for organisations that needed more time: a Set-SPOTenant -DelayContentSecurityPolicyEnforcement $true flag that pushed enforcement from 1 March to 1 June 2026. If your IT team enabled that flag, you bought yourself 90 days.

Those 90 days are now running out.

The purpose of the delay was to give organisations time to audit their environments, fix non-compliant scripts, and test changes, not to skip preparation entirely. If you haven't started yet, this post is your starting gun.

The pattern we've seen with 1 March enforcement is that the teams who struggled were the ones who started late. Trusted Script Source changes can take up to 24 hours to propagate across a tenant. If you're making changes on 30 May and something doesn't propagate in time, you have no margin for error.

Eight weeks sounds like plenty of time. In practice, the audit usually surfaces more than expected, vendor responses take longer than expected, and internal sign-off processes take time. Start now.

If your SharePoint environment includes solutions from third-party vendors, analytics tools, chatbots, form builders, or similar, those vendors may need to update their products to be CSP-compliant. Reach out to them with the specific violation URLs from your Purview audit and ask for a compliance timeline.

In the meantime, you can temporarily register their script sources as trusted, but the long-term fix needs to come from their end if their solutions use inline scripting patterns.

Here's something that surprises people who haven't been through a full SharePoint migration: the actual moving of data is often not the hardest part.

Before you migrate a single document, you need to know what you have. That means auditing every site collection, every document library, every custom permission level, every workflow, every Add-In, every integration that touches SharePoint. In environments that have been running for five or ten years, that audit alone can take weeks.

Then comes the conversation about what to bring across, what to rebuild, and what to retire. Classic SharePoint Designer workflows won't survive the migration to SharePoint Online as-is. They need to be rebuilt in Power Automate. Add-Ins built on the retiring framework need to be redesigned using modern solutions. InfoPath forms need to be replaced.

None of that is technically impossible. All of it takes time.

• April 2, 2026: SharePoint Add-Ins and classic SharePoint 2013 workflows retire. Any business process built on these frameworks stops working. This isn't a 'soft' retirement with a grace period — it's a hard cutoff.

Let's talk about what happens when organisations start their migration planning in Q1 2026 instead of now. A few things tend to happen:

A properly planned SharePoint migration isn't just a technical exercise. It has several distinct phases, and each one has genuine business value:

• Environment assessment: Understanding exactly what you have — content, customisations, permissions, integrations, and ROT (redundant, obsolete, and trivial) content that doesn't need to move at all.
• Workflow and Add-In inventory: Cataloguing every automated process and identifying what needs to be rebuilt in modern tools like Power Automate and Power Apps.
• Migration path decision: Choosing between SharePoint Online, SharePoint Subscription Edition, or a hybrid approach based on your compliance requirements and cloud strategy.
• Phased execution: Running pilot migrations, validating, then executing in phases with proper testing at each stage.
• Change management and adoption: Making sure your users understand what's changed, why it changed, and how to work effectively in the new environment.

Start that process now and you have time to do each of those things properly. Start it in January 2026 and you're making hard choices under pressure.

Whether you are a large association, an SME, or a sector body navigating complex stakeholder environments, the challenge with Microsoft 365 is rarely the technology itself. It is adoption; it is knowing which tools to prioritise; it is having a partner who understands your context before prescribing a solution.

That is why our approach to IT support (for the agricultural sector in South Africa and across every industry we serve) starts with listening. We ask the hard questions: Where are the gaps? Which tools are going unused? What is creating friction for your team day-to-day? And what does a realistic, achievable roadmap actually look like for your organisation?

For our A Team clients, this kind of session is part of the package; not an add-on, not a special occasion. It is what a premium, long-term Microsoft 365 support relationship looks like in practice.

Quietly, intentionally, and with a clear plan. No fanfare. Just the work.

Not every organisation has the same needs, and that is exactly the thinking behind our Blue Sky Events. Blue Sky is GTconsult's exclusive, interactive Microsoft 365 workshop format, designed to bring certified M365 specialists directly to your team (on-site or virtually) anywhere in South Africa.

Every Blue Sky session is built around your organisation's specific challenges and goals. There is no generic content, no off-the-shelf slides; just practical, hands-on learning with actionable takeaways your team can implement immediately. Whether that is streamlining collaboration in Teams, unlocking automation through Power Automate, or getting more from tools your team already has access to, we build the session around what actually matters to you.

Blue Sky Events are open to everyone: existing GTconsult clients and organisations simply exploring what better Microsoft 365 support in South Africa could look like for them.

Yes. GTconsult provides Microsoft 365 support and M365 consulting across South Africa, including KwaZulu-Natal, the Western Cape, and beyond, both on-site and virtually.

We work across sectors including agriculture, financial services, insurance, retail, and more. Our M365 consulting approach is tailored to each organisation's context; it is never a one-size-fits-all solution.

No. Blue Sky Events are open to any organisation interested in getting more from their Microsoft 365 environment. Whether you are an existing client or brand new to GTconsult, there is a session for you.

There's a version of this conversation that happens after an incident. After a breach. After data has been exfiltrated, or systems have been locked down by ransomware, or a client calls asking why their data appeared somewhere it shouldn't.

That conversation is expensive. Remediation is expensive. Reputational damage is expensive. Regulatory exposure (especially under POPIA) can be very expensive.

A penetration test, run proactively, finds the same problems before they become incidents. It's the difference between fixing a lock and explaining to your clients why their data is gone.

We've seen it go both ways. Businesses that test regularly catch things early and fix them quietly. Businesses that don't, often find out the hard way — and at the worst possible time.

It's a fair question because the phrasing can feel a bit abstract. Here's what it means in plain language:

After July 14, 2026, Microsoft will no longer release security updates for SharePoint Server 2016 or 2019. They won't fix bugs. They won't patch vulnerabilities. If a cyber threat specifically targets your version of SharePoint, Microsoft will not respond. You're on your own.

Your server won't suddenly shut down. Everything will look exactly the same the morning of July 15. Files will still open. Sites will still load. But underneath that familiar interface, you'll be running a platform that no longer has anyone watching its back.

Here's what makes this even more urgent: July isn't the only deadline you need to worry about.

On April 2, 2026, Microsoft is retiring the SharePoint Add-In model and classic SharePoint 2013 workflows- permanently. If your environment relies on workflows built in SharePoint Designer, approval processes tied to the Add-In framework, or third-party add-ins using Azure ACS authentication, those things will stop working before July even arrives.

April 2, 2026. That's less than a year away as you're reading this.

This affects more organisations than you'd think. A lot of business-critical processes, finance approvals, HR routing, records management, procurement sign-offs, were built on classic SharePoint workflows. When these retire, they don't just slow down. They break.

• SharePoint Server Subscription Edition (SE): The on-premises path for organisations with compliance requirements or data sovereignty constraints. Released in 2021, it runs on Microsoft's Modern Lifecycle — no fixed end-of-life date.

• Hybrid approach: Combining on-premises SharePoint SE with SharePoint Online for organisations that need a phased transition or have specific data that must remain local.

If your SharePoint environment went down tomorrow, not a migration, just an unplanned outage after July 2026, how long could your business operate? Who would you call? What would your IT team do without a Microsoft support ticket to open?

That's the risk you're accepting by waiting.

At GTconsult, we've spent 15 years helping organisations navigate SharePoint migrations. We know what a well-planned migration looks like, and we know what a rushed one costs. The difference is almost always time — specifically, how much of it you have left when you start.