Microsoft has disclosed a new spoofing vulnerability affecting SharePoint Enterprise Server 2016, 2019, and Subscription Edition. CISA added it to their Known Exploited Vulnerabilities catalogue the same day the patch was released, and ordered US federal agencies to patch by 28 April 2026.

As of this week, researchers have identified 1,370 SharePoint servers still publicly exposed and unpatched, more than a week after Microsoft released the fix.

And as Kyle pointed out in our conversation, that number is almost certainly understated.

The previous vulnerability was a Remote Code Execution flaw, which means an attacker could run any code they wanted on the system. Last week's vulnerability is described as a spoofing vulnerability, which sounds less alarming, but is worth understanding properly.

It is tempting to look at 1,370 unpatched servers and assume those organisations are simply not paying attention. The reality is more nuanced.

For organisations running large or complex SharePoint environments, applying a patch is not a single click. It often involves a structured release process: testing the patch in a staging environment, validating that it does not break existing integrations, and pushing it through a formal change management board for approval. In heavily regulated industries, that approval chain alone can take weeks.

This is the question we asked Kyle directly, and his answer is one every business leader should sit with for a moment. SharePoint is not a particularly insecure platform. It sits behind multiple layers of defence and integrates tightly with Active Directory and Microsoft Entra ID.

What has changed is that SharePoint has become a far more valuable target. Since SharePoint 2016, the platform has matured significantly, and many of the largest organisations in the world now run mission-critical environments on it. Larger, more valuable deployments mean attackers have a stronger commercial incentive to invest time in finding ways in.

There is also a second factor: artificial intelligence. AI tools are helping attackers analyse code paths and chain together small, individually low-severity vulnerabilities into something far more dangerous.

In other words, you cannot only worry about the headline-grabbing CVEs. The medium-severity ones matter too, because attackers are increasingly stitching them together.

SharePoint Server 2016 reaches end of extended support on 14 July 2026. After that date, Microsoft will no longer issue security patches for SharePoint 2016. Whatever vulnerabilities exist in the code, including ones not yet discovered, will remain there permanently.

If you are running SharePoint 2016 and you have not yet started a migration conversation, this is the signal to start. The migration path is not a single jump. Organisations on 2016 cannot move directly to SharePoint Subscription Edition. They need to upgrade to 2019 first, then to Subscription Edition, or rebuild the environment and migrate the data across using a migration tool.

Both options take time. Three months out from the deadline, that time is now the constraint.

If you are not sure whether your SharePoint environment is patched, exposed, or ready for the July 2026 deadline, our team can help you find out. We offer SharePoint security assessments, vulnerability scans, penetration testing, patch verification, and full migration planning for SharePoint 2016 environments.

Reach out to us and we will walk through your environment with you. 

For SharePoint on-premises users, the retirement means Microsoft stops providing support, updates, and security patches. The forms may continue to function, but you’re operating on borrowed time with unsupported software. That creates real risk across three areas:

This is where organisations often get stuck. Not every InfoPath form should be rebuilt the same way. The right replacement depends on what the form does and how complex it is.

For forms that are part of broader business processes and need rich integration with other systems, Power Apps is often the right direction. It’s Microsoft’s official successor to InfoPath, tightly integrated with SharePoint, Teams, and the wider Power Platform. For workflows, Power Automate replaces what SharePoint Designer used to do.

But here’s the honest truth: Power Apps isn’t always the fastest path for straightforward SharePoint list forms. Some forms don’t need the full Power Platform treatment. They need a modern, responsive form that works natively in SharePoint without the overhead of a canvas app build.

This is where it gets practical. One of the biggest headaches with InfoPath migration is the manual effort. Reading form designs, recreating layouts, reconnecting data sources, rebuilding logic. For organisations with dozens or hundreds of forms, that’s months of work.

GTconsult partners with Lightning Tools, whose Form Migrator is purpose-built for exactly this problem. The tool scans your SharePoint environment, detects InfoPath forms, reads the form design including layout, images, repeating tables, and logic, and lets you preview the form before publishing it to a SharePoint list.

From there, you have flexible options. You can migrate to Power Apps for forms that need standalone app capabilities. Or you can migrate to Lightning Forms for SharePoint-native forms with conditional formatting, cross-site lookups, and automation built in. The Form Migrator handles both form design and data migration, preserving field values, attachments, metadata, and relationships.

The entire process runs locally on your workstation. No form data leaves your environment. For security-conscious organisations, that matters.

Lightning Tools also includes an ROI calculator within the tool, so you can see exactly what the migration saves you compared to rebuilding forms from scratch.

Need help with your InfoPath migration?

Chat to GTconsult. Let’s assess your environment and build a plan before the deadline.