Microsoft SharePoint CVE-2026-105013

Exploitation requires a valid authenticated SharePoint account with at least low-level privileges (PR:L) and network reachability to the affected SharePoint service; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The core prerequisite is that the attacker can reach an endpoint that deserializes untrusted input (CWE-502). The principal limiting factor is the authentication requirement - this is not exploitable by a fully unauthenticated attacker - so risk concentrates where SharePoint accounts are widely provisioned or where the server is internet-exposed to authenticated users. Specific vulnerable configuration, feature, or endpoint details are not disclosed in the provided data and should be confirmed from the MSRC advisory.

This is a credible but moderate-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) confirms network-based, low-complexity exploitation requiring low-level privileges (PR:L = an authenticated, authorized user), with no user interaction and a changed scope (S:C). The impact metrics are notably all Low (C:L/I:L/A:L), which is unusual given the description states code execution - the vendor-assigned impacts appear conservative, so the real-world consequence of CWE-502 deserialization-to-code-execution may be understated by the 7.4 base score; verify severity with Microsoft's MSRC advisory. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit identified, so exploitation status is: no public exploit identified at time of analysis. No SSVC decision data was supplied. Net: the authentication requirement (PR:L) and absence of any observed exploitation make this a patch-in-normal-cycle item rather than an emergency, but the deserialization code-execution class and scope change warrant prompt remediation in internet-reachable SharePoint deployments, since authenticated access to SharePoint is often broadly granted within an organization.

An attacker who already holds a low-privileged authenticated account on a SharePoint site submits a maliciously crafted serialized object to a vulnerable endpoint over the network. When the server deserializes the untrusted data (CWE-502), it executes attacker-controlled code, and the changed scope allows impact beyond the initially exploited component. No public exploit code is identified at time of analysis, and exploitation requires valid credentials (PR:L), limiting opportunistic use.