EUVD-2026-29576
GHSA-pqmq-26jw-5r2g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable deserialization needing only a low-privilege authenticated account (PR:L) with no user interaction, yielding code execution for total C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated attacker to run arbitrary code across the network by submitting maliciously crafted serialized data (CWE-502). Any user holding low-privilege authenticated access to the SharePoint web application can achieve total compromise of the server (C:H/I:H/A:H). There is no public exploit identified at time of analysis, and the EPSS probability is modest at 0.50% (66th percentile), but the impact is total and a vendor patch is already available.
Technical ContextAI
The flaw is a Java/.NET-style unsafe deserialization issue (CWE-502) in Microsoft SharePoint Server, the on-premises collaboration and document-management platform built on ASP.NET and IIS. SharePoint's server-side handlers accept serialized object payloads; when untrusted input is deserialized without adequate type validation or allow-listing, an attacker can smuggle a gadget chain that executes code during object reconstruction. The CPE data confirms the affected code base spans three parallel product lines that share the 16.0 core: microsoft_sharepoint_enterprise_server_2016, microsoft_sharepoint_server_2019, and microsoft_sharepoint_server_subscription_edition. Deserialization bugs are a recurring root cause in SharePoint due to its heavy use of serialized state and workflow objects passed between client and server.
RemediationAI
Apply the Microsoft security update for your edition per MSRC advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33110 - Vendor-released patch: update SharePoint Enterprise Server 2016 to 16.0.5552.1002 or later, SharePoint Server 2019 to 16.0.10417.20128 or later, and SharePoint Server Subscription Edition to 16.0.19725.20280 or later. Because these are farm-wide updates, install the security update on all servers in the farm and then run the SharePoint Products Configuration Wizard (PSConfig) to complete the upgrade, as skipping PSConfig can leave the farm partially patched. Until patching is complete, reduce exposure by restricting network reachability of the SharePoint web front-ends to trusted internal networks or VPN (removing direct internet exposure), tightening account provisioning so untrusted or low-trust users cannot obtain authenticated SharePoint access, and monitoring IIS/SharePoint ULS logs for anomalous serialized payloads and unexpected worker-process (w3wp.exe) child processes; note these controls limit but do not eliminate risk since any legitimate authenticated user remains a potential vector.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today