Office365 CVE-2025-47163

This vulnerability presents HIGH real-world risk based on multiple threat signals: (1) CVSS 8.8 with Network Attack Vector and Low Complexity indicates it is readily exploitable once an attacker gains authenticated access; (2) The Low Privilege requirement (PR:L) means any valid SharePoint user—including external collaborators, contractors, or compromised low-privilege accounts—can trigger exploitation; (3) Deserialization vulnerabilities are well-understood attack class with predictable gadget chains (particularly in .NET); (4) SharePoint environments are common targets in enterprise ransomware and lateral-movement campaigns; (5) The lack of User Interaction (UI:N) means exploitation can be automated at scale without social engineering. If KEV status confirms active exploitation or POC is available, this escalates to CRITICAL priority. The real-world risk is amplified by the fact that many organizations maintain complex, legacy SharePoint deployments with delayed patching practices. EPSS data (if >0.95) would reinforce the urgency. This is NOT a low-real-risk-despite-high-CVSS issue—authenticated code execution in a centralized collaboration platform is a business-critical threat.

An attacker with a valid SharePoint user account (obtained through credential theft, insider threat, or account compromise) connects to the target SharePoint Server via its web interface or APIs. The attacker crafts a malicious serialized .NET object payload leveraging known gadget chains (e.g., ObjectDataProvider, WindowsIdentity chains) and sends it to a SharePoint service endpoint that deserializes user-supplied data without proper validation—likely through document upload, list item creation, workflow parameter handling, or custom web service calls. Upon deserialization, the malicious payload instantiates a chain of objects that ultimately executes arbitrary PowerShell or native commands with the identity of the SharePoint application pool (typically a service account with elevated permissions). The attacker gains code execution in the context of the SharePoint process, enabling them to: extract sensitive data from SharePoint databases, move laterally to backend SQL servers or file shares, deploy persistent backdoors, or escalate to full domain compromise. If POC code is publicly available, automated exploitation tools can be rapidly developed, turning this into a worm-like threat in networks with unpatched SharePoint instances. Detection is challenging because the exploit leaves minimal forensic traces—the attack is a single malformed request triggering deserialization, not a series of network connections or file modifications.