EUVD-2025-17736CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
AnalysisAI
Critical deserialization vulnerability in Microsoft Office SharePoint that allows authenticated attackers to execute arbitrary code remotely without user interaction. The vulnerability affects SharePoint environments where untrusted data is deserialized, enabling network-based code execution with high impact to confidentiality, integrity, and availability. While no public exploit code has been confirmed in open intelligence sources, the CVSS 8.8 rating and low attack complexity suggest this is a high-priority patch for all affected organizations.
Technical ContextAI
This vulnerability stems from CWE-502 (Deserialization of Untrusted Data), a well-known attack vector where SharePoint server-side components fail to properly validate or sanitize serialized objects before deserialization. Microsoft Office SharePoint likely uses .NET serialization (BinaryFormatter, NetDataContractSerializer, or similar) for inter-component communication or data persistence. An attacker with valid SharePoint credentials can craft malicious serialized payloads that, when deserialized by the server, instantiate dangerous object chains leading to arbitrary code execution. This is particularly severe in SharePoint because the service runs with elevated privileges and often has access to backend databases and external resources. The vulnerability requires Low privilege access (PR:L) but has No User Interaction (UI:N) required, meaning it can be triggered programmatically via SharePoint APIs or web services.
RemediationAI
Immediate remediation steps: (1) Apply the latest security patch from Microsoft for your SharePoint version immediately—Microsoft typically releases cumulative updates (CUs) and security updates (SUs) monthly; (2) Verify patch installation by checking build numbers against Microsoft's official guidance; (3) If immediate patching is not possible, restrict network access to SharePoint services using firewall rules and network segmentation to limit exposure to trusted users and systems only; (4) Disable or restrict access to SharePoint REST APIs and SOAP web services if not required for business operations; (5) Enforce multi-factor authentication (MFA) for all SharePoint user accounts to reduce the risk of credential compromise enabling the attack; (6) Monitor SharePoint logs and application insights for suspicious deserialization patterns, unusual object instantiation, or authentication anomalies. Consult Microsoft's official advisory and KB article (search 'CVE-2025-47163' on Microsoft Security Update Guide or MSRC portal) for specific patch versions, build numbers, and validated remediation steps. Enterprise customers may reference their Microsoft support contract for prioritized guidance.
More from same product – last 7 days
Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil
Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal
Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-
Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti
Privilege escalation in Microsoft Entra ID enables remote unauthenticated attackers to bypass origin validation and gain
Share
External POC / Exploit Code
Leaving vuln.today